Extracted

• • Target

    f3391c58d32a8b234f7a196e3ae60aed4bcaea30415a48d6732a588cf2aaf3d2.bin

  • Size

    1013KB

  • MD5

    2faf9d3b87e288c45deee6ba0807b77b

  • SHA1

    a3384c6bcda732d8836f47b0710dbf1aa1562722

  • SHA256

    f3391c58d32a8b234f7a196e3ae60aed4bcaea30415a48d6732a588cf2aaf3d2

  • SHA512

    f7080758bed7bdb60f30bd40dc2ed407756531d6ab1250823a015b6f1ea052657c2fc8b128305cc689ebddd901a49c35f63d10636ec8ba5cd330af9604c0eae1

  • SSDEEP

    24576:RkBmTwT+Pk9TbBBA/R2EBc/HtvO2SMSdGrW:RMTZTbBBA/sPwdGK

  Score

  10^/10

  alienbotbankerevasioninfostealerstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3