errorfather | f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7

Target
f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
Size 8.7MB
Sample260914-mflaysbj7v
SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
MD5 12f5c6dd1ffdddab60d6da95216274e5
SHA1 77299594efea59d7c1d7a32fed95f35e24b8f874
SHA512 9f82fcc715ee6a8560e8092fe334e4e259d202fcb0f76c28134b2f1451bedc3f867bdace0e5d1ac5b739c642d395c4f915e89b016b9748ad229d2af07fce4e22
SSDEEP 196608:1VrMawyBMI8WszaGO/xohiP1V5C01VeeUK2zDr5Pqz8tW+:Xgawyx82GOJ4iPD1Ve9DrlXtW+
TLSH
T1BD96238EE3C98B5BCBEE4B7C4A36522312279E12575396BF8698F678143F1E40F548C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Family

https://api.telegram.org/bot7779906180:AAE3uTyuoDX0YpV1DBJyz5zgwvvVg-up4xo/sendMessage?chat_id=5915822121&text=

Family: ErrorFather
ErrorFather is an Android banking trojan based on Cerberus first seen in October 2024.
trojan infostealer banker errorfather
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7

SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
MD5 12f5c6dd1ffdddab60d6da95216274e5
SHA1 77299594efea59d7c1d7a32fed95f35e24b8f874
SHA512 9f82fcc715ee6a8560e8092fe334e4e259d202fcb0f76c28134b2f1451bedc3f867bdace0e5d1ac5b739c642d395c4f915e89b016b9748ad229d2af07fce4e22
SSDEEP 196608:1VrMawyBMI8WszaGO/xohiP1V5C01VeeUK2zDr5Pqz8tW+:Xgawyx82GOJ4iPD1Ve9DrlXtW+
TLSH
T1BD96238EE3C98B5BCBEE4B7C4A36522312279E12575396BF8698F678143F1E40F548C1
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Digest

0961926f8a660f9197ffca31c06ea0f68c5c9448563aa8028e87ae825daf615a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=AT Software Inc.,OU=AT Software Inc.,O=AT Software Inc.,L=SAO PAULO,ST=SP,C=BR

cosmos.scrubber.pupil

Permissions

android.permission.INTERNET

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.QUERY_ALL_PACKAGES