Extracted

• • Target

    7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82

  • Size

    2.4MB

  • MD5

    3516d7b0d815d8c48dd6785c1b885e4c

  • SHA1

    af9d581f7ab4871c6dde28e0bd277ac370e67396

  • SHA256

    7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82

  • SHA512

    ddcedf17501d7c5fd004c32d377cf8429bc116acda3c9b5ab0928f757072bd7a7e75b050d601f3fd18549bb5804373d047704c68763beaaaf6c31e1b15c10040

  • SSDEEP

    49152:i6WLvEZiJwF2RF0t+XwSCiS8ckt2fd6yQW1s6/GNsTZZZZdZROlGNkWFBJdfSbHu:5NdNiS8cOXcG0ZZZZdX6W/Jdf1

  Score

  10^/10

  alienbotcerberusbankerevasioninfostealerratstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3