Extracted

• • Target

    8a9e2ecc89f8190eeda6a5574222d764

  • Size

    1.5MB

  • MD5

    8a9e2ecc89f8190eeda6a5574222d764

  • SHA1

    cbda65c114994affc4f0a87567398c0a11e42776

  • SHA256

    1c530b6be1b94f43588b7a3cc3bf3c41b4ad5cc1c687ca6a64be628019d49f3c

  • SHA512

    c02a92f23171221beaae3f75cb869947e9f661c6cd20cd1ead675e8ece1197234087cd1bf657e91094fe49295931197bad12f73e0596552e0682a65934cc084f

  • SSDEEP

    24576:H547kbuQ7rkgnwIlnrfH/4w2TedoHNj/Ldz4iid2UurtNc3+FTrtIOk9RKgJ:zpnwI9rfH/3dWNrLdz40dRFvtIOk9oI

  Score

  10^/10

  alienbotcerberusbankerevasioninfostealerratstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3