Extracted

• • Target

    a517cf91ae88e25572bb63b02f2ac8daa1ce639084efaf22995b67e5625971ba

  • Size

    1.7MB

  • MD5

    a9dc94e57fef85c9f77ad3e3847266e9

  • SHA1

    def03d968941f2e7d50166d80e4855057d5a5d45

  • SHA256

    a517cf91ae88e25572bb63b02f2ac8daa1ce639084efaf22995b67e5625971ba

  • SHA512

    fb780a5d28541b556f4c1e574798c7ffae4e84af12758939f9f663c25633eae650abed6df381ddb05e2e4e3df51b3ddcc9d9a7172f7d5c1876c5e1086e6b93b6

  • SSDEEP

    49152:6+mduyML94AQgmY1yOd2sadY4m7ryDrv/3aHbWSsxl:DXyKKMTysadYR7uDb/3kbI

  Score

  10^/10

  cerberusbankerevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3