Extracted

• • Target

    1742936fc3118792758eaecef0991ea3

  • Size

    2.6MB

  • MD5

    1742936fc3118792758eaecef0991ea3

  • SHA1

    c939e399263a53f5e5e4563085e5ff85a7ab0352

  • SHA256

    057809e3b42b8b7a4f437a8cdbed5f7b78da66127794f8a9bf4f686693544be3

  • SHA512

    13fd7c45e0af19d37336bea774977ab074aecb285f24e7e95cb23bb0d4b460f1165ccd014d532f8c9a45842bd2779205834048eb06896b4b9819581090a30b7a

  • SSDEEP

    49152:rPUYehPA5dhtJMZejNQLHmWSCcA0+RBKCRvwCXj0AxhAg6o:LUYexAbdMZUOlh9xwCXoAxhKo

  Score

  10^/10

  alienbotcerberusbankerevasioninfostealerratstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Checks Android system properties for emulator presence.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3