Extracted

• • Target

    ef80429d554a6f7a0b1ad97a2ca5df4d

  • Size

    160KB

  • MD5

    ef80429d554a6f7a0b1ad97a2ca5df4d

  • SHA1

    18492f451511e2f736646ed61778365c6936f342

  • SHA256

    2b43af46398ece7b9e1e41bb7c2e2ff3ec227edb38283bea7622115bb76a7823

  • SHA512

    11c0599ce5b3a82b0438a8a41d965417e45fb41ba9b8511a6104544738270bf1c4abff0429c20957dc7427663e7c4281529330d068364ef64f50c61c1e828c17

  • SSDEEP

    3072:gMG+RF83rVeAghsxDehY8JqdkBHqH+QQDDDRsI9OsI90/HdXAdPZ/HdXAdP+l:gm6rVeAghEDvKqduiQq4Xk/Xk+l

  Score

  10^/10

  cerberusbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1