Overview

overview

10

Static

static

10

chrome virus.apk

android-11-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    chrome virus.apk
  • Size 4.6MB
  • Sample260301-kbvbysfv8e
  • SHA256 c54861f54bcf72de5f16611ef0eec32c5c5f937bf3fdb5d6e611b2a2f9acdf2a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
herodotusandroidbankerdefense_evasionevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • herodotus

C2

  • wss://www.google.com

Targets

    • Target
      chrome virus.apk
    • Size 4.6MB
    • SHA256 c54861f54bcf72de5f16611ef0eec32c5c5f937bf3fdb5d6e611b2a2f9acdf2a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerdefense_evasionevasionherodotusimpactinfostealerpersistencerattrojan

    • Herodotus

      Herodotus is an Android banking trojan that evades detection by mimicking human behavior, first seen in October 2025.

      bankertrojaninfostealerratherodotus

    • Herodotus family

      herodotus

    • Herodotus payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      defense_evasionpersistence

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Requests enabling of the accessibility settings.

    behavioral1

MITRE ATT&CK Mobile v16

Tasks