cerberus | a1a036bba5ca8d139b01d2c60e40bfdb4bb07a41ca7bc28ac3e37fd2e1db1121

General

Target

ChromeUpdate6.3.1.apk
Size

2.6MB
MD5

cb8b3fda1574c806c3a980804f272366
SHA1

8e9b4ea24215340d92324dd1ca91b3b816a87940
SHA256

a1a036bba5ca8d139b01d2c60e40bfdb4bb07a41ca7bc28ac3e37fd2e1db1121
SHA512

4cf01b825ef0bd47b8098ba1d39890ca5d4e5ba3f0e4ffc6d42e29ba28b679ee76ee51886314ed1db83c2f9f0c653f97b97b7c9d34099423ba51b5e8e69ca213

Score

10^/10

cerberus banker evasion infostealer obfuscation rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://santrader.ga

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

possible.identify.thank

pid process

3612 possible.identify.thank

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

possible.identify.thank

ioc	pid	process
/data/user/0/possible.identify.thank/app_DynamicOptDex/CqM.json	3612	possible.identify.thank
/data/user/0/possible.identify.thank/app_DynamicOptDex/CqM.json	3612	possible.identify.thank

Uses reflection 25 IoCs

obfuscation

Processes:

possible.identify.thank

description	pid	process
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method android.content.res.AssetManager.addAssetPath	3612	possible.identify.thank
Invokes method android.app.ContextImpl.getAssets	3612	possible.identify.thank
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method android.content.res.AssetManager.open	3612	possible.identify.thank
Invokes method java.io.FilterInputStream.read	3612	possible.identify.thank
Invokes method java.io.FilterInputStream.read	3612	possible.identify.thank
Invokes method java.io.BufferedInputStream.read	3612	possible.identify.thank
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method java.io.BufferedInputStream.close	3612	possible.identify.thank
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method java.lang.String.getBytes	3612	possible.identify.thank
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method java.io.FileOutputStream.write	3612	possible.identify.thank
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method java.io.FilterOutputStream.close	3612	possible.identify.thank
Invokes method android.app.ActivityThread.currentActivityThread	3612	possible.identify.thank
Acesses field android.app.ActivityThread.mPackages	3612	possible.identify.thank
Invokes method java.lang.reflect.Field.get	3612	possible.identify.thank
Invokes method java.lang.Object.getClass	3612	possible.identify.thank
Invokes method java.lang.ref.Reference.get	3612	possible.identify.thank
Invokes method java.lang.ref.Reference.get	3612	possible.identify.thank
Acesses field android.app.LoadedApk.mClassLoader	3612	possible.identify.thank
Invokes method java.lang.reflect.Field.get	3612	possible.identify.thank
Acesses field android.app.LoadedApk.mClassLoader	3612	possible.identify.thank

64 IoCs

Processes:

possible.identify.thank

pid	process
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank
3612	possible.identify.thank

possible.identify.thank
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:3612

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads