Extracted

• • Target
    c41fe911cb688cfeed73ab07960a7a05_JaffaCakes118
  • Size 2.9MB
  • SHA256 90b4ea5b5b05d0651610e4f07ba3809bfa43a4bee2cd96c5880a63e68fe75840
  • MD5 c41fe911cb688cfeed73ab07960a7a05
  • SHA1 405fa53700ce104ed339ede1daf49f442945a92d
  • SHA512 3ebac26fe4c4fddf03b521f80c969f43a07af34d9605263a77948989eac44a571c4a8e50378abeae496490e97bdd2bb2bc0dfb22bc515a4cb501506baa180500
  • SSDEEP 49152:fd/2ZPtCQShVxqqw4eR4nki0Zpf28+ec3Ep0O9jloXaxmk:V+Z0Q6LqgeRAki0Zt7Tc3Eb5loXaxmk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3