Extracted

• • Target

    f50a8b6f416d2efb30fe6b2b5f83b9da_JaffaCakes118

  • Size

    2.7MB

  • MD5

    f50a8b6f416d2efb30fe6b2b5f83b9da

  • SHA1

    da162c0a3ae612ee779ff781e60b4362880fc7a8

  • SHA256

    cf3bd3c242555867a1e6bdd07e7c9dcc5df5ba5cf15e24ed12ac7e1bc533f829

  • SHA512

    ed3663d0a26262080617d1d7d4e665b772468bfb0f4f9e65fac79649a4db9ee5eeb624e79372a3c50abc4537380e4512484397ae3d6c8cb72a882647598669f7

  • SSDEEP

    49152:s61N+7Je9Q2uXqn3xz0ujzfowyw5ueQ4HM+8GyOUIXCbic3xN1i937reqK:B1Mk9QzXqn3tjzwwyw5hQ4H2GyOUIybv

  Score

  10^/10

  cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3