Overview

overview

10

Static

static

6

apk.apk

android-11-x64

10

Resubmissions

01/07/2026, 19:12

260701-xwq69aey7z10

01/07/2026, 08:37

260701-kh45qsb14t10

01/07/2026, 00:51

260701-a7sg5adt8110

Analysis

  • max time kernel
    11s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    01/07/2026, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    apk.apk
  • Size 3.0MB
  • Sample260701-a7sg5adt81
  • SHA256 78533e66970f86f2a8f583b40a54c5c4a70afadda811ace35cd7380352765b1b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bankerevasionherodotusimpactinfostealerrattrojan

Malware Config

Signatures

  • Family: Herodotus

    Herodotus is an Android banking trojan that evades detection by mimicking human behavior, first seen in October 2025.

    bankertrojaninfostealerratherodotus
  • Herodotus payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • sruddRsS.RmRCrBNLwB.ymVWwbF
    1⤵
    • Loads dropped Dex/Jar
    • Performs UI accessibility actions on behalf of the user
    • Requests enabling of the accessibility settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4726

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        crash_log.txt
        • Path /data/data/sruddRsS.RmRCrBNLwB.ymVWwbF/files/crash_log.txt
        • Size 1KB
        • SHA256 168c69bfa563758ac933a8d6ee5c6f5be6e5b2fd1d11c6feaa1e09912c6dda59
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/sruddRsS.RmRCrBNLwB.ymVWwbF/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 6de52f889b82bd5a0847b567bbdfe202fe14cf89fdd74e92f35a451b8e1cad27
        • MD5 SHA1 SHA512
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/sruddRsS.RmRCrBNLwB.ymVWwbF/primary.prof
        • Size 163B
        • SHA256 f6ebed0d996ea96e65729991c851247c7b4962e15915eec247054137df55bd2b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        [email protected]
        • Path /data/user/0/sruddRsS.RmRCrBNLwB.ymVWwbF/[email protected]
        • Size 602KB
        • SHA256 5281e44fdd82e2c79a54b145517bc7295dd14adc10ca69ec6986dcc242394ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Download