Extracted

• • Target

    1f9749e79441b7ad455ff8bd6802e7bfee98abd2d9832b270389078033a2d794.bin

  • Size

    1009KB

  • MD5

    b21329c916c0a083e42e817b8491981f

  • SHA1

    3aaf1f036dc8cffd0a777c5bcb67039888faf60a

  • SHA256

    1f9749e79441b7ad455ff8bd6802e7bfee98abd2d9832b270389078033a2d794

  • SHA512

    0c90f7d0b263beddeb0330c30a4a8331ad37f28e6161666928a38faf9ec2608f4eb0a5094735d2f9a196b495d198e09d6e25a4b36e024fc16bb76a917a0b95b7

  • SSDEEP

    12288:OvrGcc4LVwwKvZxWcruFb6CAjAbvqvxMgaY1ZPDshjLM8veYqS0DQ365muQY:oGUVw9LSFb6CaksxkiPY3TGVQK5muQY

  Score

  10^/10

  alienbotbankerevasioninfostealerstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3