Extracted

• • Target
    jaffacakes118_a78f571b8c8720297f4be6769bd3325c0204160b25257aa26c681bfc1626df04.bin
  • Size 3.6MB
  • SHA256 a78f571b8c8720297f4be6769bd3325c0204160b25257aa26c681bfc1626df04
  • MD5 0150be5b050e73f7bf15fae2b698d245
  • SHA1 161e532f09ec1955dca9ac93be3275167030d161
  • SHA512 219351b24086dd7d9886322c079bdf117a7652debd6ad2ab20339f1768b0435cb71c0a5f048b7010714cebfb8e15a43dcb7006465250afe7fd98f4ed11e31db0
  • SSDEEP 98304:wINjG8Nr3dUdzhEjvBFDdkzzE3RrISuIih6jcLYNZ7xO/DTw:ZjbzdUFWdFeKr8XecLYN9xOo
  • TLSH
    T184063364F096D211E8FB27785B72A1A24C363E67CE53417B3824BBAC19736D10F11F9A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionhydrainfostealerpersistencetrojan

  • Family: Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3