Extracted

Extracted

• • Target
    77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55
  • Size 373KB
  • SHA256 77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55
  • MD5 59c64251c8fe18be645070a2efedc5e8
  • SHA1 77a9f61f16d5befbbc1d8c9e70bff621cd18ed98
  • SHA512 a7498920bd226d2aeaacf5af64f0c9770f0c202b0df4f37227e758bc548e8f9c1b036d17b176b39569566f69c88297be929583cc31ac8086795aeef3faf8b7dc
  • SSDEEP 6144:qVdgXvzSKDTrlnwUW627eMC8F9iZK3ZBu9ZjUDWP02oQ8KRUtDutBaBjBjfpIbwg:qV+ffPlnwf6rFKJ49Zj2VQbahua5MbUU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  alienbotcerberusbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistencerattrojanstealth

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Alienbot family

    alienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus family

    cerberus

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2