Extracted

• • Target

    ae338ecd0e84e30cb0962d26ea2797cb

  • Size

    3.2MB

  • MD5

    ae338ecd0e84e30cb0962d26ea2797cb

  • SHA1

    04d1634a310fa44282d8abe6763dfd851d84c4d4

  • SHA256

    4a3d77f8c3e8d8ecbbfeda70b661f57dc4d2382996615938c71de6a4cfc2f03f

  • SHA512

    9cd57469232cc692b4321df7eb1b630426f2921611801221212b8abd2a5a75b95d811a43835e8030222c8ca105c0eed850152e4f2c850d34bd1ffccd1c233aa8

  • SSDEEP

    49152:s5V2pYyoevMC7JZ2AMrvHGFOWkMHlkOIdrg3nD2nexrqP+BNfEsholdZOOUkv:5ToekpepQW6neh7ei4v

  Score

  10^/10

  cerberusbankercollectionevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3