hydradragonantivirus/hydradragonav-mobileAndroid Antivirus which doesn't require root, adb, ca install and cloud with many features and ways to detect more zero-day malware
Advanced Android Antivirus With Threat Protection
⚠️ Project on hold. This project did not get enough interest, so I have paused it for a while. Development has moved to HydraDragonAntivirus.
(Logo made by discord user called: 1tophbeifong)
-3DDC84?style=for-the-badge&logo=android){kind=icon}
HydraDragonAV Mobile is a multi-layered Android Antivirus and Security suite combining static analysis (YARA-X + ClamAV signatures + code anomaly detection), dynamic behavior analysis, and a lightweight on-device ML classifier — all gated by a NSRL-backed whitelist so known-good software is never a false positive. Designed with a Zero-Trust architecture, it actively defends the device against ransomware, clickjacking, spyware, SMS scams/phishing, and zero-day threats. When a flagged malware app is launched, it is automatically force-stopped and blocked in real time.
📋 Requirements: Android 8.0 Oreo (API 26) or newer. The per-app dynamic network analysis — attributing each DNS/connection to the exact app that made it and feeding it to the YARA-X
hydradragonmodule — relies onConnectivityManager.getConnectionOwnerUid, which is only available on Android 10+. On Oreo/API 26-28 the rest of the suite still runs, but per-app connection attribution is unavailable.
🤖 Android-only detection scope. This is a minimalist, Android-focused fork of the original HydraDragonAntivirus — it only detects Android malware. The native scan engine only runs its ClamAV/YARA-X signature matching on files it can confidently identify as an Android-relevant type (APK/ZIP, DEX, ELF, HTML, ASCII text, PDF, images); desktop-only formats (Windows PE, OLE2/Office, Mail, Mach-O, Java) and files of an indeterminate type are skipped entirely, rather than scanned with a signature database that was never meant for them. For more details, see the wiki (ClamAV Integration, Known Limitations).
ConcurrentHashMap caching to instantly re-verify previously scanned safe applications with zero CPU overhead.libhydradragonandroid.so) does the heavy lifting — YARA-X + ClamAV signature matching, archive extraction (zip/gz/tar/xz/lzma/7z/rar, including nested APKs), AXML manifest parsing, and dangerous-permission counting, all straight from bytes in memory (no temp files required).AIEngine) also scores DEX-level behavior (obfuscation, dynamic loading, crypto/socket/shell APIs, adware SDKs).HydraDragonAV Mobile operates across four core pillars:
libhydradragonandroid.so) — evaluating X.509 certificates, SHA-256 hashes, dangerous permissions, app install sources, YARA-X/ClamAV signatures, and ML anomaly scores.A local DnsVpnService additionally filters DNS lookups against known-malicious domains, and a NetworkSecurityScanner/NetworkMonitor pair watches live connections for MITM interception, ARP spoofing, and malicious IP/C2 traffic.
Tools like Shizuku grant an app ADB-shell-level privileges (process killing, PackageManager operations beyond the public API, real iptables-style firewalling, etc.) without full root. It's a legitimate, useful project — just not the right fit inside a production antivirus:
adb shell (wireless or USB debugging) or root, each time, unless the device is already rooted — completely impractical for a mass-market install, and this app already refuses to run at all on rooted devices (RootCheck) and warns the user when USB/wireless debugging is left on (DebugModeCheck/DebugModeWarning) precisely because both states widen the attack surface.VpnService-based DNS/domain/IP filtering (Web Shield) without ever requiring the user to authorize shell access to a third-party broker service.In short: a security product that asks the user to first grant it debug-shell reach is solving its threat model backwards. The app's actual privilege escalation surface is intentionally kept to what Android's public APIs (AccessibilityService, VpnService, PackageManager) allow — nothing that requires ADB, root, or a privileged companion app.
Early builds shipped a TLSH fuzzy-hashing engine that compared every scanned APK/ELF/DEX against a MalwareBazaar-derived digest database. It was removed because it was the slowest, heaviest, and least useful engine in the whole suite:
The features that actually earn their place — YARA-X + ClamAV signatures, the ML classifier, NSRL whitelisting, emulation, and URL/IP filtering — cover the same ground without the runtime cost or the empty promise of "100%".
Designed with 💻 by @elnureisayeva1-cloud (creator) & @Siradankullanici (backend development)
Note: the maximum file size the engine will scan is user-configurable from Settings (10–2048 MB, default 650 MB) — files above the limit are skipped entirely rather than partially scanned.
Clone the repository (submodules included — the native engine vendors a custom YARA-X fork with the hydradragon scanning module):
git clone --recurse-submodules https://github.com/HydraDragonAntivirus/HydraDragonAV-Mobile.git
cd HydraDragonAV-Mobile
Build the native Rust engine for Android (see hydradragonandroid/README.md for prerequisites):
cd hydradragonandroid
build-android.cmd
Build the Android app as usual (Gradle) — the native .so output is picked up automatically from app/src/main/jniLibs/.
The on-device detection assets are generated offline from public threat-intel and NSRL sources, then bundled into the app:
gen_whitelist_packages.py — builds whitelist_packages.db (SQLite), a full-detail NSRL Android package whitelist (name, version, manufacturer, OS, hashes) joined from the NSRL RDS database.gen_whitelist_apk.py — extracts whole-APK NSRL MD5 hashes for the native binary-fuse XOR whitelist filter.gen_ip_lists.py / build_url_xfilters.py / build_xfilters.sh — build the malicious IP/URL/domain filters (XOR-filter based) used by the native IP/URL threat scanners.clam_juice.py — filters ClamAV signatures to keep only Android-relevant platforms (Andr, Unix, Linux, Email, PUA) plus all Phishing signatures; excludes Win/Osx/Java:
python clam_juice.py --directory database_non_filtered --output database_filtered --profile cross-platform
fdroid-downloader.py — downloads benign APKs from the official F-Droid repository for the dataset pipeline. Only downloads APKs not already present locally; compares by filename so updated versions are picked up automatically.dataset/benign/F-Droid/ — collected F-Droid open-source APKs (benign by nature with 2805 APKs). https://huggingface.co/datasets/HydraDragonAntivirus/BenignAPKDataset/tree/main (uploaded via "hf upload-large-folder HydraDragonAntivirus/BenignAPKDataset dataset\benign --repo-type=dataset --num-workers=4")dataset/malware/ — malware samples (stored separately, not in this repo. Link: https://drive.google.com/file/d/1Il2bvcjxmc0w-XirL27R0_bKpznIeIiG Password: infected).BroadcastReceiver intercepts and scans newly installed/updated APKs automatically. Background scans can be adopted by the UI if the user opens the scan screen mid-scan — no redundant re-scan.JNI_OnLoad/entry code in a bounded, syscall-free CPU sandbox (ARM/ARM64/x86/x86_64) to reveal strings — like a C2 URL — that a decode/decryption routine only produces at runtime, never as static plaintext. Fully toggleable from Settings.http(s):// URL from a scanned file's raw bytes (APK or otherwise) and checks it against the native malware/phishing URL xor filters — a full URL (with path) is far more specific than a bare domain, meaning fewer false positives and more precise detections than domain-only matching.FLAG_WINDOW_IS_OBSCURED check, and an inhumanly fast burst of setting changes (the signature of a malicious accessibility service driving the UI directly) is detected, reverted, and blocked, so only the actual device owner can ever change protection settings.