Extracted

• • Target

    c41fe911cb688cfeed73ab07960a7a05_JaffaCakes118

  • Size

    2.9MB

  • MD5

    c41fe911cb688cfeed73ab07960a7a05

  • SHA1

    405fa53700ce104ed339ede1daf49f442945a92d

  • SHA256

    90b4ea5b5b05d0651610e4f07ba3809bfa43a4bee2cd96c5880a63e68fe75840

  • SHA512

    3ebac26fe4c4fddf03b521f80c969f43a07af34d9605263a77948989eac44a571c4a8e50378abeae496490e97bdd2bb2bc0dfb22bc515a4cb501506baa180500

  • SSDEEP

    49152:fd/2ZPtCQShVxqqw4eR4nki0Zpf28+ec3Ep0O9jloXaxmk:V+Z0Q6LqgeRAki0Zt7Tc3Eb5loXaxmk

  Score

  10^/10

  cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3