New Hydra Trojan Targets European Banking Users

Cyble Research Labs analyzed a phishing campaign delivering a Hydra Android banking trojan impersonating the CommerzBank mobile app; the sample requests dangerous permissions (including Accessibility and Device Admin), hides malicious DEX code via a custom packer, and implements advanced features such as Accessibility-based remote-control (TeamViewer-like screencast), TOR-based C2 retrieval, SOCKS proxying, Play Protect disabling, SMS/contact exfiltration, and premium service fraud. The report includes APK metadata, manifest and source-code observations, execution behavior, C2/Ioc artefacts (SHA256 hashes, hosting IP, .onion proxy URL, and decoded C2 URL), mapped MITRE ATT&CK techniques, and recommended remediation steps (uninstall/factory reset, block IoCs, update AV/OS, use official stores and MFA).