HydraDragon Antivirus

HydraDragonAV Mobile is a multi-layered Android Antivirus and Security suite combining static analysis (YARA-X + ClamAV signatures + code anomaly detection), dynamic behavior analysis, and a lightweight on-device ML classifier — all gated by a NSRL-backed whitelist so known-good software is never a false positive. Designed with a Zero-Trust architecture, it actively defends the device against ransomware, clickjacking, spyware, SMS scams/phishing, and zero-day threats. When a flagged malware app is launched, it is automatically force-stopped and blocked in real time.

🚀 Key Features ⚡ Photon Technology: Ultra-fast, multi-threaded scanning engine utilizing ConcurrentHashMap caching to instantly re-verify previously scanned safe applications with zero CPU overhead. 🧠 Native Rust Scan Engine: A JNI-bridged Rust core (libhydradragonandroid.so) does the heavy lifting — YARA-X + ClamAV signature matching, archive extraction (zip/gz/tar/xz/lzma/7z/rar, including nested APKs), AXML manifest parsing, and dangerous-permission counting, all straight from bytes in memory (no temp files required). 🧠 Burn ML Binary Classifier: A tract-based Burn malware/benign classifier scores every scanned APK with a confidence value (0.0–1.0). Trained on both malware and benign datasets for accurate binary classification. A lightweight logistic-regression classifier (AIEngine) also scores DEX-level behavior (obfuscation, dynamic loading, crypto/socket/shell APIs, adware SDKs). 🛡️ Ransomware & Screen-Locker Mitigation: Real-time on-screen text detection (via Accessibility Service + OCR) recognizes ransom notes and forcefully terminates screen-locking ransomware, in 20 languages. 📵 SMS Scam & Phishing Detection: The same multi-language on-screen text scanner catches smishing lures (fake account verification, prize scams, parcel-delivery scams, OTP requests, bank alerts) wherever they're rendered — Messages app, notification previews, or a spoofed WebView — without ever reading your SMS inbox directly. 🖥️ Live Screen OCR: A MediaProjection-based capture service periodically OCRs the foreground screen and feeds the extracted text into the native threat scanner, catching scams that only ever appear as rendered pixels. 🖼️ MalwareFoundActivity as Dialog: When a threat is detected during a background scan, a floating dialog overlay (not a full-screen activity) alerts the user without disrupting their current task. 🚫 UI Hijacking / Clickjacking Protection: Detects and blocks automated rapid-click permission-granting attacks, notification-spam floods, and repeated overlay/dialog abuse from malicious apps. Task-hijacking (StrandHogg activities-count check) and a screen-recording/FLAG_SECURE guard are also built in as opt-in Settings toggles (the FLAG_SECURE guard can be intentionally disabled via an "Allow screen recording" toggle — tamper detection still catches unauthorized removal). 🔍 On-Install & On-Demand Scanner: Quick (installed apps only) or Full (entire storage including SD card) scans; a BroadcastReceiver intercepts and scans newly installed/updated APKs automatically. Background scans can be adopted by the UI if the user opens the scan screen mid-scan — no redundant re-scan. 🎯 Active Threats Counter: A dedicated "ACTIVE THREATS" stat on the scan screen shows the number of currently-detected threats alongside the scanned/threat totals. 📋 Rich Threat Dialogs: Tapping a threat shows all detection reasons in a bulleted list with clickable VirusTotal URLs for immediate verification, plus Destroy / Ignore / Ignore-Signature actions. 🌐 Network Security Monitor: Tracks live connections, flags known-malicious/C2 IPs (validated as public IPv4 before scanning — private/loopback/multicast addresses are rejected) and anonymizer/tunnel-service-shaped domains (dyndns, ngrok, .onion lookup attempts), detects MITM/TLS interception via untrusted CAs, and can spot ARP spoofing on the local network. (Domain/DNS-based — this observes plain-DNS lookup patterns, not actual Tor circuit traffic, which never touches the device's DNS resolver.) 🌐 DNS-Filtering VPN (Web Shield): A local, on-device VPN service blocks resolution of known-malicious/phishing domains — no traffic proxying, decryption, or inspection, only DNS lookups are filtered. 🗃️ NSRL-Backed Whitelisting: Known-good software is cleared through two independent NSRL-derived layers — a binary-fuse XOR filter of whole-file SHA-256 hashes (native, in-memory) and a SQLite database of full NSRL package metadata (name, version, manufacturer, OS) — so a legitimate app is never flagged, while a malicious hash can never "borrow" a whitelist entry by luck. 🔒 Zero-Trust Mode: Optional stricter mode where any app that merely survives every detector (rather than being explicitly cleared) is still flagged as suspicious, with a full audit trail. 🧠 Behavioral Detection Suite: A dedicated set of runtime detectors, each individually toggleable from Settings — UI/notification-spam (adware), a device-became-rooted-mid-session monitor, a combined permission+suspicious-DNS-pattern risk score, and ransomware behaviour detection (see below). Every hit immediately kills the offending app's background process (where possible) and pops the system uninstall prompt right away, instead of waiting for the next scheduled scan. 🪤 Ransomware File Traps: When a freshly-installed, still-unvetted app is granted "All Files Access", HydraDragon temporarily drops a decoy file (named to sort first in a typical alphabetical encryption pass) into Downloads/Documents/Pictures/DCIM. Any rename, content change, or deletion of that file — something no legitimate app has a reason to ever touch — is 100% certain ransomware behaviour, not a heuristic guess. Traps auto-expire within 24 hours so they never clutter a user's files. 🔁 Rename-Burst Ransomware Detection: Independently, a burst of files being renamed with an appended suffix (whatever that suffix actually is — no hardcoded ".enc"/".locked" list) shortly after an app gains file access is flagged as in-place encryption, the filesystem-level shape every ransomware family shares regardless of its specific extension. 🐴 Native-Code Emulation (Unicorn Engine): Runs an embedded native library's JNI_OnLoad/entry code in a bounded, syscall-free CPU sandbox (ARM/ARM64/x86/x86_64) to reveal strings — like a C2 URL — that a decode/decryption routine only produces at runtime, never as static plaintext. Fully toggleable from Settings. 🎣 Malicious/Phishing URL String Scanning: Extracts every embedded http(s):// URL from a scanned file's raw bytes (APK or otherwise) and checks it against the native malware/phishing URL xor filters — a full URL (with path) is far more specific than a bare domain, meaning fewer false positives and more precise detections than domain-only matching. 🔐 Settings Self-Protection: Every Settings toggle/button is hardened against non-human tampering — an overlay-based tapjacking attempt is blocked via Android's own FLAG_WINDOW_IS_OBSCURED check, and an inhumanly fast burst of setting changes (the signature of a malicious accessibility service driving the UI directly) is detected, reverted, and blocked, so only the actual device owner can ever change protection settings. 🧹 Bloatware Cleaner, Self-Protection & Root Detection: Rounds out the suite with background-app cleanup, Device Admin tamper/uninstall resistance, and rooted-device detection. 🌍 Multilingual Support: Fully localized UI and threat-detection keyword lists across 20 languages: English, Turkish, Spanish, German, French, Russian, Portuguese, Arabic, Italian, Dutch, Polish, Ukrainian, Chinese (Simplified), Japanese, Korean, Hindi, Indonesian, Vietnamese, Persian, and Thai.