Extracted

Extracted

• • Target
    c5e3edafdfda1ca0f0554802bbe32a8b09e8cc48161ed275b8fec6d74208171f
  • Size 2.3MB
  • SHA256 c5e3edafdfda1ca0f0554802bbe32a8b09e8cc48161ed275b8fec6d74208171f
  • MD5 e80c4ffa4acd192981d142c435c52c49
  • SHA1 009fd7faf9dc52fd96bbfde826bbb4058409b8b8
  • SHA512 7255b61cc7969dcf8be0c32d09d94e299cad60ded377f0af38e19d665302fbb72e87bf918987c7c8628edbf9d3e4944596b1c7a68567a06f49a138648724c11f
  • SSDEEP 49152:sgmbZCDt7SEQT54zDfLIf/4DYWYvQQa7cBf3yQzkyxI0rd+I+Zsc0wGhpdojx:gs57wADzZDhYoloRyQwyxldKsc0wGhpA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  crocodilusbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

  • Crocodilus

    Crocodilus is a banking malware with extensive remote control capabilities first seen in March 2025.

    bankertrojaninfostealerratcrocodilus

  • Crocodilus family

    crocodilus

  • Crocodilus payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3