Extracted

• • Target

    724326854d7a9a690804dddd1b2a8238

  • Size

    3.2MB

  • MD5

    724326854d7a9a690804dddd1b2a8238

  • SHA1

    77648e958dae35902a2da8e78abf1f63df6fbaff

  • SHA256

    ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa

  • SHA512

    bcdede85ed64d46007907e03fefda9170bdbbdd05ebcc83a42fc7aed54aa3fcf529dcd348e3bf9ed044e805a1e5e6861d589b7a10c86440c66d0254230fc7f71

  • SSDEEP

    49152:FjswnszFXACO2rlrANH99yeSmjpHe/4zXLc8CycUsrYPPbk5/Ehi7vXBYc:4ZACOIW9EeUIbc8WUa4kGyp

  Score

  10^/10

  cerberusbankerevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Tries to add a device administrator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3