Extracted

• • Target

    fd4fa33f9fb8f0fbc62d60f83a0ee287_JaffaCakes118

  • Size

    2.9MB

  • MD5

    fd4fa33f9fb8f0fbc62d60f83a0ee287

  • SHA1

    f1e6da0a218dc77c60c441e882923841af8435d4

  • SHA256

    1811bd1c7300746f8eb515ce096834ac4524a80c2fc990b7f4874e070501ddf7

  • SHA512

    60a729a0b2445322f9641e4eb8f964b064b0b77b3ccec61f06e53ef877cc6cd1ef89b00c41c47722f5e4e9a1804f1784afad346764e0e1f529f532c0ba549e1f

  • SSDEEP

    49152:sEBaYhGdUKqRQ9wnHIdKVDoSYqixkJGlHlODoqwjg5V0J6X:BYqG7qBHImDUDkJgH8Ufk7CC

  Score

  10^/10

  cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Registers a broadcast receiver at runtime (usually for listening for system events)

    persistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3