Fake Document Manager App Downloading Hydra Banking Trojan

Cyble Research Labs discovered a malicious Android app on the Google Play Store masquerading as a "Document Manager" that acts as a hostile downloader for Hydra banking-trojan variants. The analysis provides APK metadata and hashes, describes a social-engineered fake update flow that requests INSTALL_PACKAGES and Accessibility permissions, documents C2/TOR communications and packed payloads, lists IOCs (hashes and URLs), and maps observed behaviors to MITRE ATT&CK techniques; the app reportedly achieved over 10,000 downloads and can steal SMS/OTP, contacts, cookies, and abuse Accessibility to prevent removal.