Extracted

• • Target
    jaffacakes118_0a88bd3d6f1b9af36826274b593648140d7621e75cc70b7604f29b7b67dc75f6.bin
  • Size 3.6MB
  • SHA256 0a88bd3d6f1b9af36826274b593648140d7621e75cc70b7604f29b7b67dc75f6
  • MD5 3718c7287dc521b52cdce0b995916435
  • SHA1 9bbf9cb07ce1296381acd85de80f6246cc3b6827
  • SHA512 43a9455105c3af5e81a2d97dc46c8c295f0b8f78a436d740111c55ed218d5f2f8e070bea9f02f7a5fd846db3c251b29905289328afc0d20c6ca29a5bf1b4de3e
  • SSDEEP 98304:4nF+DXwmGRh9R/EjeZLMQJVyvRud7Rk44/3KrQ2lTt:m/meb8gMI3Rk1PuTB
  • TLSH
    T1A2063310F95DC606E5BA17B84B9AD0A6133DBE1ADF1BD28F6029732C18736C45F50BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionhydrainfostealerpersistencetrojan

  • Family: Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3