Overview

overview

10

Static

static

10

f0c5f41cde...2e.apk

android-11-x64

10

Resubmissions

25/12/2025, 00:18

251225-alqfmssje110

21/11/2025, 10:26

251121-mgsreseq5v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f0c5f41cde6805629993f709996ee73beb34699e0aa2b349832d65cfbc7a792e.bin
  • Size 4.7MB
  • Sample251121-mgsreseq5v
  • SHA256 f0c5f41cde6805629993f709996ee73beb34699e0aa2b349832d65cfbc7a792e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
herodotusandroidbankerdefense_evasionevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • herodotus

C2

  • google-firebase.digital

Targets

    • Target
      f0c5f41cde6805629993f709996ee73beb34699e0aa2b349832d65cfbc7a792e.bin
    • Size 4.7MB
    • SHA256 f0c5f41cde6805629993f709996ee73beb34699e0aa2b349832d65cfbc7a792e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bankerdefense_evasionevasionherodotusimpactinfostealerpersistencerattrojan

    • Herodotus

      Herodotus is an Android banking trojan that evades detection by mimicking human behavior, first seen in October 2025.

      bankertrojaninfostealerratherodotus

    • Herodotus family

      herodotus

    • Herodotus payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      defense_evasionpersistence

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Requests enabling of the accessibility settings.

    behavioral1

MITRE ATT&CK Mobile v16

Tasks