Extracted

• • Target

    085da022ed5149e3a0eb4a539010934f_JaffaCakes118

  • Size

    136KB

  • MD5

    085da022ed5149e3a0eb4a539010934f

  • SHA1

    868c0694b2df4a86a38fa50ac6c1806e3ef3b1e0

  • SHA256

    1249c4d3a4b499dc8a9a2b3591614966145daac808d440e5202335d9a4226ff8

  • SHA512

    bfdd30270bbf30c51a08d07336f2f3a2be42b430abe67952d34446bb15fe6effe357939e09728e4e522ff204b97833dcc5fcc97e6fc4e74d36c005ad5b062f29

  • SSDEEP

    3072:mgjLQQJ8R6PE/x64DqLo9rAdqxq2JOHJOK8O8PwA4zRwA4zFUlvDm8DUlvDm8d:mgjLQQJW6PKxFsJdqxqnI7HoA4zuA4zX

  Score

  10^/10

  cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojanimpact

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3