General
- Target 340bfbd674dd9389b4c7148cf5ee004f641d0dc94753e1fe66acc98cd9ae525b.apk
- Size 2.3MB
- Sample260813-ccqfdsgb99
- SHA256 340bfbd674dd9389b4c7148cf5ee004f641d0dc94753e1fe66acc98cd9ae525b
Malware Config
Targets
-
- Target 340bfbd674dd9389b4c7148cf5ee004f641d0dc94753e1fe66acc98cd9ae525b.apk
- Size 2.3MB
- SHA256 340bfbd674dd9389b4c7148cf5ee004f641d0dc94753e1fe66acc98cd9ae525b
Score10/10-
Family: Hydra
Android banker and info stealer.
-
Android banker: accessibility service abuse with overlay injection
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
-
Contact harvesting with SMS self-propagation
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
-
Silent screen capture via MediaProjection
Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.