Extracted

• • Target

    f9303b059ae1a24483e5d49dbc92e381_JaffaCakes118

  • Size

    3.1MB

  • MD5

    f9303b059ae1a24483e5d49dbc92e381

  • SHA1

    1714f02ec60a1f6332a5e189fd4c6561515e769a

  • SHA256

    6b615be3461706b5e54d9bd7261894b9afbad226d5070f861aeaa5351253170c

  • SHA512

    0056af0010c79f41afebcafb6a9a978974164963b3a55a856fe77f7182687b2d6481f5dee75f966294e4018afd68eb6c2acc48a168302e9aeaedea976b072625

  • SSDEEP

    49152:NShcx/P8JH9F/Hg229ZkmbRH2nZT0OgFXiN2PgNv7gIVe0vI46qmEKFpOV9nujJ:cK8JdF8D7g4OAZ6gIQ346jEe02V

  Score

  10^/10

  cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3