Extracted

• • Target
    rojadirectatv.apk
  • Size 11.7MB
  • SHA256 b1e83615e07999862f15f5649656941f754db4ed31458b4b6b5ba9d36bc1b1b3
  • MD5 660abb82b0bb7680008633d90390f9ee
  • SHA1 ccdaccb065d45439309ed85597c5101086765ab5
  • SHA512 dd96f360332c3fb408c05dd8dab19b9eae6ef1f43b678f291ab8d8f22ddcc24ca621832a885c3cf5eed65c4f40ce7bd820f0f9832bb1eaee3dd838e131a3e693
  • SSDEEP 196608:AwQXv3s+I9aKl8pjtvzbzIDk4v2w3keLx6+h8FfUZX9HVf1rb3ve2mPGo389PSJq:AwQvs+12OZvzb+/2w3j1h8F+dZ0d8M0h
  • TLSH
    T1C3C62296F305A99FC8F6873349B242B911475D258F8386D72C48B23C19B76E85F89FC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  collectioncredential_accessimpact

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1
• • Target
    zarttapurt.apk
  • Size 4.8MB
  • SHA256 0e9eb3a7e4dcc7e29a99a40e489a587cc20b80dbd7d9a2925f9e9edebeffb84e
  • MD5 16411d02a521979b39d0f71c992be1da
  • SHA1 f9681c91312fddb2da2974020d155ffde2628d6c
  • SHA512 dba333c8a756940c4d10350792036d8e795c897e05ff1ace6d2804ce260b7146b148388727bbbbe15eb063572d52f7baf912f6b0bb7762a5fbaca4aa402e8151
  • SSDEEP 98304:yd53PnnqvlhXdObw3ai3XYHdgfwLo73UDZr7SE/Msy4E5:AnyPX4bw3ai3XYq2C3Clt/Msy4q
  • TLSH
    T1BA36F083F759B56FC8F6C3378A3156A2150B9C228F4397872958733C19BB6C04EA5EC9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutioncerberusimpactinfostealerpersistenceratstealthtrojan

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus family

    cerberus

  • Checks if the Android device is rooted.

    defense_evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks known Qemu files.

    Checks for known Qemu files that exist on Android virtual device images.

    defense_evasion

  • Checks known Qemu pipes.

    Checks for known pipes used by the Android emulator to communicate with the host.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Acquires the wake lock

  • Checks the application is allowed to request package installs through the package installer

    Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Checks the presence of a debugger

    defense_evasion
  behavioral2