Extracted

• • Target

    af0be4d92dbc9bdd672840c70caa37887e60174e157d2010d1d60c36e0f574f6

  • Size

    1.9MB

  • MD5

    1b2f876311097bda3b6d566bb15d9f56

  • SHA1

    0a8845dc99eff46dbfc86f695dba39332ac724db

  • SHA256

    af0be4d92dbc9bdd672840c70caa37887e60174e157d2010d1d60c36e0f574f6

  • SHA512

    b43abc18041f2903f7ca5ac4ed2ac6d99ebd9f4d5f5fdbb247bbf4dcdd1e7f86a61a4bb266068f6b56038bd5ba23ed2620fc70f22e36fccce5d2c00eed6f3ec1

  • SSDEEP

    49152:RTMfyks21IPHohhhn5JKjLa3xxlSeB2cTf:RTMfyk91lhhhnrKfa3xxlSM2C

  Score

  10^/10

  cerberusbankerevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3