Extracted

• • Target
    5628dab224ebad1364bf2ac4815b8b9b32b143055262a57ddc13ff1bf42ba46f.bin
  • Size 2.5MB
  • SHA256 5628dab224ebad1364bf2ac4815b8b9b32b143055262a57ddc13ff1bf42ba46f
  • MD5 f1323f138d69c6a95b0ff960f4f83bf4
  • SHA1 58e66a580a7bc0dbcadef9404abd1ec972c622a8
  • SHA512 b722c3df89d14a98c3b168aab1d863e5f3174df883967c268fe5e3de8a1a205b91fcb1963e3319435c8b11ba2795eba5e8cbc687273956c0e486e3cc3f44b0be
  • SSDEEP 49152:1kzGDFZX+FV3Zz0tg0hc00b+0ip+BBYw87vqhUnHHvC3Bya1gw2ZD4:6zGDFl+F1ZYS0/0WpQn8umHHq3oZD4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  errorfather24nhyeqwslzebankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerstealthtrojan

  • ErrorFather

    ErrorFather is an Android banking trojan based on Cerberus first seen in October 2024.

    trojaninfostealerbankererrorfather

  • Errorfather family

    errorfather

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1