Extracted

• • Target

    d4862294c6ff8f0143477daa672a185ab11bec2ea4dc519154ba40f18eee537b.bin

  • Size

    4.2MB

  • MD5

    323dca576f6f80d4686a114e5bbd4630

  • SHA1

    25db138426c117b696cc3557a0a83bc93daf1747

  • SHA256

    d4862294c6ff8f0143477daa672a185ab11bec2ea4dc519154ba40f18eee537b

  • SHA512

    4f4517100df7c81af27ae3bdc7b8865e682b0d74810effea80b1456c95f5abca79bae69c6483976ed1fb00184c12fdef973a275c0e7dafe653f2ca86cc2720f3

  • SSDEEP

    98304:VY5l5X9MwuU6udn2fc/q/K9tASvCxwSBrO5quGigyC7Lj5onhMv9TfgDv:K5n74u12MeDAqliY7LjWhMv9TgD

  Score

  10^/10

  alienbotbankercollectionevasioninfostealerstealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2