Extracted

• • Target

    3f029ec0fdfef78efd091a09e71ed01b40b2903b33cb2dfab058bd304260dde1.bin

  • Size

    3.3MB

  • MD5

    33fcb8f3dd910618cd8ac775144ad9d0

  • SHA1

    8d631703a738b0b8b3800edea66c1db9f423a308

  • SHA256

    3f029ec0fdfef78efd091a09e71ed01b40b2903b33cb2dfab058bd304260dde1

  • SHA512

    ff1d6cff175ea2306de90f0c162b8ec12e983e44ac056725461044dbd86a1a7123e435fd772e90e04139839fb53868d630a3c71260beb51fde1cc7773ace109f

  • SSDEEP

    98304:k+dM2912PhlGN34mxhi8+NVLpyTTooGnrhAQ4bav3ljZCMqvhf:k+dM2/2PhKh+NVL0UprFljZCfvhf

  Score

  10^/10

  alienbotcerberusbankerevasioninfostealerratstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Checks Android system properties for emulator presence.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3