hydradragonantivirus/hydradragonav-mobileAndroid Antivirus which doesn't require root, adb, ca install and cloud with many features and ways to detect more zero-day malware
Advanced Android Antivirus With Threat Protection
⚠️ Project on hold. This project did not get enough interest, so I have paused it for a while. Development has moved to HydraDragonAntivirus.
(Logo made by discord user called: 1tophbeifong)
-3DDC84?style=for-the-badge&logo=android){kind=icon}
HydraDragonAV Mobile is a multi-layered Android Antivirus and Security suite combining static analysis (YARA-X + ClamAV signatures + code anomaly detection), dynamic behavior analysis, and a lightweight on-device ML classifier — all gated by a NSRL-backed whitelist so known-good software is never a false positive. Designed with a Zero-Trust architecture, it actively defends the device against ransomware, clickjacking, spyware, SMS scams/phishing, and zero-day threats. When a flagged malware app is launched, it is automatically force-stopped and blocked in real time.
📋 Requirements: Android 8.0 Oreo (API 26) or newer. The per-app dynamic network analysis — attributing each DNS/connection to the exact app that made it and feeding it to the YARA-X
hydradragonmodule — relies onConnectivityManager.getConnectionOwnerUid, which is only available on Android 10+. On Oreo/API 26-28 the rest of the suite still runs, but per-app connection attribution is unavailable.
🤖 Android-only detection scope. This is a minimalist, Android-focused fork of the original HydraDragonAntivirus — it only detects Android malware. The native scan engine only runs its ClamAV/YARA-X signature matching on files it can confidently identify as an Android-relevant type (APK/ZIP, DEX, ELF, HTML, ASCII text, PDF, images); desktop-only formats (Windows PE, OLE2/Office, Mail, Mach-O, Java) and files of an indeterminate type are skipped entirely, rather than scanned with a signature database that was never meant for them. For more details, see the wiki (ClamAV Integration, Known Limitations).
