Extracted

• • Target
    f505a92ec494fcb1bfeddd0a76b922af_JaffaCakes118
  • Size 4.2MB
  • SHA256 f96fe97104d33743f476e7b3c5bbd1f5cced9bfa4837bab347c46e4eaf3309ea
  • MD5 f505a92ec494fcb1bfeddd0a76b922af
  • SHA1 7d96dd3fb13ad5e54c32b8af9e689547befad53a
  • SHA512 d78c9a5a892920786edb478522fca913f9f0da88e1c342ce378e580f693cf0bbac42d3e479a9ca5887c32dd2ae0d858cf67450f79d43ab22395ffc5b9ec9165f
  • SSDEEP 98304:DWe/Oh4YWVQv413RpujwQTavY3qIH3u50jISGjE5fmo7:CKM4nHLpus+GobR7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  alienbotbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries account information for other applications stored on the device.

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2