Extracted

• • Target
    46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e.bin
  • Size 1.4MB
  • SHA256 46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e
  • MD5 eca3407f98415c4f08d658bd9d79baed
  • SHA1 a1ed126ec9958155b412ed167595e7ae3be6244e
  • SHA512 9d13611e58fe4a2efb5edef6f338683bc79fb28f061ce152a75ee72258a41273ffafaa40075c95d37960a11d47484af3c8cbb2c415cad9b82948322832a4d40b
  • SSDEEP 24576:tzsb6yn1n28BlCg1RtpLdJe/Ffkhy9ZyR3LrSAKemosWhWmCp:mDn12wlCg95dJuFfxIR3LrSDemJWhLCp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cerberusbankercollectioncredential_accessevasionimpactinfostealerratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Requests enabling of the accessibility settings.

  behavioral1