Extracted

• • Target

    bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c

  • Size

    3.5MB

  • MD5

    6867394eea32e373ced9dc534ddcdf33

  • SHA1

    98dc6dd89137b4d97338f25894074d98c9eb7adb

  • SHA256

    bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c

  • SHA512

    23d6dcaebfb5ee7d6ee92aa325657a521fd6cf445eb1b3bc6714ddbb87e50410751f53d470d622d50da9e55f04d23f669f7af33e1de305d53257c2c5c4a28d30

  • SSDEEP

    98304:X3lFtx240S8vmU23MYC3SNcgSM6G5q3qdDlE3FGP+X:3240S6mU2tC3SGk5uqdDlE3UGX

  Score

  10^/10

  cerberusbankerevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3