Extracted

• • Target

    113db41da8155b317f84e9764ba1e7dc

  • Size

    3.2MB

  • MD5

    113db41da8155b317f84e9764ba1e7dc

  • SHA1

    1eaa388c6971e32dc1ee65a4a63008fe4d8be223

  • SHA256

    601e0e63ff7e1b7f8fffb42139c8a8049dc13b871840ddd08aa5933436582e1c

  • SHA512

    eef649500f2c49bee4431197adb352f7d55ca6a681f7d7493392f71b8315cbc5878e106894718d17e29e253876aeeac2c26f21f5db504cc748295073e242a728

  • SSDEEP

    49152:OTGWSDpf4ZPqZsBo80+yBuGn3H6rSF7fPU41qaZHAFKPP3FTXnNxdGeCVfD2r2:G8flX80jBrKww6og1TrdG1Vqy

  Score

  10^/10

  cerberusbankerevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3