Extracted

Extracted

Extracted

• • Target
    53dd304c9aacdd00c7957ad7a3546592af8a837f6e98a6e385bd03e308b87bb9.bin
  • Size 2.7MB
  • SHA256 53dd304c9aacdd00c7957ad7a3546592af8a837f6e98a6e385bd03e308b87bb9
  • MD5 3d513eec2883b6260c83d1b113eefea9
  • SHA1 5c37c8f2649797b51d197dbd4fd5efac269903c9
  • SHA512 2b4a75f892476604014c00b215ec10d4182914a5a28657877cb45d5115c9750d481b0e4c841bb37443dab34280728cc5c572eac4e28bdf6a76457ec7bc448f40
  • SSDEEP 49152:0G9XRlgK6/M1I8AwOe95aewsG5PB7K9G72mNsaNJ1hZNz+1Ze2iX:0G9iUpAEKyGf7KPmNsavZNzuZo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  • Declares services with permission to bind to the system

  • Requests dangerous framework permissions

  behavioral1behavioral2behavioral3
• • Target
    final-signed.apk
  • Size 2.4MB
  • SHA256 49a58ed751488182e2bd1a1cc284fd16b9b0768f5238119369341c7d753fff90
  • MD5 119f796087bd8c359500792de7722d94
  • SHA1 aa9606b1af552e46bd57db8f0c64aac88a5af897
  • SHA512 475d64439a014eea8510c39552240dcdd6270faa363ec1cfd2c439f5f8e4c2064721b6f19d206ffdbaecc51783800f8c1239b318b3dacbaf6a40c5c6aa59d7e8
  • SSDEEP 49152:qXADz0cbnQk4sK5DlF8XI3CrIhWChaB91gwKxCV:KADD8cKHF8GCchrh1xCV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  errorfatheryl1m11lz4sjubankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojann4h9w0s35gxcimpact

  • ErrorFather

    ErrorFather is an Android banking trojan based on Cerberus first seen in October 2024.

    trojaninfostealerbankererrorfather

  • ErrorFather payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral4behavioral5