cerberus | 29d21cfc5299759a285ffe86ee9edd0cc2883a65edfba30cd738314823926789

General

Target

29d21cfc5299759a285ffe86ee9edd0cc2883a65edfba30cd738314823926789.apk
Size

3.5MB
MD5

c851a900efcb00d89d683528365788bf
SHA1

eaa9e3487a10d3c5907bdfc2fb2d57e5023957a1
SHA256

29d21cfc5299759a285ffe86ee9edd0cc2883a65edfba30cd738314823926789
SHA512

346c0cb04fee66d700b6d91f862a48a0df33693f1851e4a0031afd075d8d9ecff466d58d613cd84f4cd25826385e1fee1e43e3cce50b1713ab1658efe46a308c

Score

10^/10

cerberus banker evasion infostealer obfuscation rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://45.153.185.116/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

project.salute.energy

pid process

4690 project.salute.energy
Checks Android system properties for emulator presence. 1 IoCs

Processes:

project.salute.energy

description ioc process

Accessed system property key: ro.product.model project.salute.energy

pid	process
4690	project.salute.energy

description	ioc	process
Accessed system property	key: ro.product.model	project.salute.energy

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

project.salute.energy

ioc	pid	process
/data/user/0/project.salute.energy/app_DynamicOptDex/SpLhNR.json	4690	project.salute.energy
/data/user/0/project.salute.energy/app_DynamicOptDex/SpLhNR.json	4690	project.salute.energy
/product/app/TrichromeLibrary/TrichromeLibrary.apk	4690	project.salute.energy
/product/app/TrichromeLibrary/TrichromeLibrary.apk	4690	project.salute.energy

Uses reflection 27 IoCs

obfuscation

Processes:

project.salute.energy

description	pid	process
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method android.content.res.AssetManager.addAssetPath	4690	project.salute.energy
Invokes method android.app.ContextImpl.getAssets	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method android.content.res.AssetManager.open	4690	project.salute.energy
Invokes method java.io.FilterInputStream.read	4690	project.salute.energy
Invokes method java.io.FilterInputStream.read	4690	project.salute.energy
Invokes method java.io.BufferedInputStream.read	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method java.io.BufferedInputStream.close	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method java.lang.String.getBytes	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method java.io.FileOutputStream.write	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method java.io.BufferedInputStream.close	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method java.io.FilterOutputStream.close	4690	project.salute.energy
Invokes method android.app.ActivityThread.currentActivityThread	4690	project.salute.energy
Acesses field android.app.ActivityThread.mPackages	4690	project.salute.energy
Invokes method java.lang.reflect.Field.get	4690	project.salute.energy
Invokes method java.lang.Object.getClass	4690	project.salute.energy
Invokes method java.lang.ref.Reference.get	4690	project.salute.energy
Invokes method java.lang.ref.Reference.get	4690	project.salute.energy
Acesses field android.app.LoadedApk.mClassLoader	4690	project.salute.energy
Invokes method java.lang.reflect.Field.get	4690	project.salute.energy
Acesses field android.app.LoadedApk.mClassLoader	4690	project.salute.energy

project.salute.energy
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Uses reflection
PID:4690

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads