Extracted

• • Target
    67130F843EBF484C6A87002C8B52218864184E07BCC50227175DF52BD23CA001.apk
  • Size 1.8MB
  • SHA256 67130f843ebf484c6a87002c8b52218864184e07bcc50227175df52bd23ca001
  • MD5 3b114ad5d6dc3c7b7a800e25994f14f4
  • SHA1 5993356afbad23bf175837b75b573384ef224da9
  • SHA512 b0a1feb00a672a72bde9eac30e6a97eb1adc86c5c45e34bb56a0b4f5dde5f276f07223d67be02ba58e63ab7f66f20a88d38618644751c3aa7be466df4c287d56
  • SSDEEP 24576:7eo2g6JF3CaKoWyJDAS/opD6GSUMfm9nCpfCSc629pihNYTFiuhO1PCg3F:7eoAtCa1WK/ot/b62kYTFh2Cg3F
  • TLSH
    T1CE9533D59B20445BF0EB2EBC32D7F22B173957A816DC8616741495AC7DEF0CA2F2AC81
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionevasionalienbotcerberusinfostealerpersistencerattrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Alienbot family

    alienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus family

    cerberus

  • Cerberus payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion
  behavioral1