cerberus | 9e0383ce956c1a31c44367d6886dc36d7e036771b6351082567a9e434cc1018d

Analysis

max time kernel
3608905s
max time network
92s
platform
android_x86_64
resource
android-x86_64
submitted
15-04-2021 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e0383ce956c1a31c44367d6886dc36d7e036771b6351082567a9e434cc1018d.apk
Size

3.3MB
MD5

3f93e3279edf578831b29bff17f59818
SHA1

25302af735ddb9fb6a2aa878915aa202ffcf7766
SHA256

9e0383ce956c1a31c44367d6886dc36d7e036771b6351082567a9e434cc1018d
SHA512

735635863c5a72f29c0cd380bdd87185b866f7010477548c32d26fec0c05fb0bf927d734a9e7faf6b0e54530d3b0a936d386cb388f09ccff561bdd5c88a06bf3

Score

10^/10

cerberus banker evasion infostealer obfuscation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://easywebb-td-online.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

basket.ask.turtle

pid process

3613 basket.ask.turtle

pid	process
3613	basket.ask.turtle

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

basket.ask.turtle

ioc	pid	process
/data/user/0/basket.ask.turtle/app_DynamicOptDex/NqZ.json	3613	basket.ask.turtle
/data/user/0/basket.ask.turtle/app_DynamicOptDex/NqZ.json	3613	basket.ask.turtle

Tries to add a device administrator. 1 IoCs

Processes:

basket.ask.turtle

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN basket.ask.turtle

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	basket.ask.turtle

Uses reflection 27 IoCs

obfuscation

Processes:

basket.ask.turtle

description	pid	process
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method android.content.res.AssetManager.addAssetPath	3613	basket.ask.turtle
Invokes method android.app.ContextImpl.getAssets	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method android.content.res.AssetManager.open	3613	basket.ask.turtle
Invokes method java.io.FilterInputStream.read	3613	basket.ask.turtle
Invokes method java.io.FilterInputStream.read	3613	basket.ask.turtle
Invokes method java.io.BufferedInputStream.read	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method java.io.BufferedInputStream.close	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method java.lang.String.getBytes	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method java.io.FileOutputStream.write	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method java.io.BufferedInputStream.close	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method java.io.FilterOutputStream.close	3613	basket.ask.turtle
Invokes method android.app.ActivityThread.currentActivityThread	3613	basket.ask.turtle
Acesses field android.app.ActivityThread.mPackages	3613	basket.ask.turtle
Invokes method java.lang.reflect.Field.get	3613	basket.ask.turtle
Invokes method java.lang.Object.getClass	3613	basket.ask.turtle
Invokes method java.lang.ref.Reference.get	3613	basket.ask.turtle
Invokes method java.lang.ref.Reference.get	3613	basket.ask.turtle
Acesses field android.app.LoadedApk.mClassLoader	3613	basket.ask.turtle
Invokes method java.lang.reflect.Field.get	3613	basket.ask.turtle
Acesses field android.app.LoadedApk.mClassLoader	3613	basket.ask.turtle

basket.ask.turtle
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Tries to add a device administrator.
- Uses reflection
PID:3613

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads