Extracted

• • Target

    8073f01858fc51092a5baa37518206ad7e6e9cc80bc08cd05675cf3944fbfc10

  • Size

    2.6MB

  • MD5

    956782fd8e0bddd07d8b57554afecb5c

  • SHA1

    a1b16e913252445f6178c15455a81c551faf66df

  • SHA256

    8073f01858fc51092a5baa37518206ad7e6e9cc80bc08cd05675cf3944fbfc10

  • SHA512

    20aa90a7e327233efc542162e3a586e6d3573d09b35d4b4484d732fffcb771fa9754eb2676a24e256da789d1834381a99b786dc126fdf462e499b6e6bb9d9e47

  • SSDEEP

    49152:hYIkzPGdaYJztU4kzoOTb2PlhmAGLK9z0ASmqt3CM3nw3HFmErO11qv:hJD6JAs3CM3gNT

  Score

  10^/10

  alienbotcerberusbankerevasioninfostealerratstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3