cerberus | bac498dd4ada78968fb82f772f1529352d72e52073fe2dbddc232be7c3f3ec14

Analysis

max time kernel
3654780s
max time network
60s
platform
android_x86
resource
android-x86_arm
submitted
16-04-2021 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bac498dd4ada78968fb82f772f1529352d72e52073fe2dbddc232be7c3f3ec14.apk
Size

3.4MB
MD5

aa7c5edc939599bc70f451eb4e125a3b
SHA1

a702ffdc2edad2d8b3b45ec4977a12710ae9b9fc
SHA256

bac498dd4ada78968fb82f772f1529352d72e52073fe2dbddc232be7c3f3ec14
SHA512

8e20f7035c5aac6857b3b065fee715974eb212b9f7a65bb3aa741cc8ad6898d6fbd58808665b8b4468f7f5faa1aa0a12f91892f87f60b8f5a599cd3cb18248bd

Score

10^/10

cerberus banker evasion infostealer obfuscation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://198.144.191.142/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

dwarf.liar.trust

pid process

4676 dwarf.liar.trust
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

dwarf.liar.trust

ioc pid process

/data/user/0/dwarf.liar.trust/app_DynamicOptDex/DYUw.json 4676 dwarf.liar.trust

pid	process
4676	dwarf.liar.trust

ioc	pid	process
/data/user/0/dwarf.liar.trust/app_DynamicOptDex/DYUw.json	4676	dwarf.liar.trust

Uses reflection 27 IoCs

obfuscation

Processes:

dwarf.liar.trust

description	pid	process
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method android.content.res.AssetManager.addAssetPath	4676	dwarf.liar.trust
Invokes method android.app.ContextImpl.getAssets	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method android.content.res.AssetManager.open	4676	dwarf.liar.trust
Invokes method java.io.FilterInputStream.read	4676	dwarf.liar.trust
Invokes method java.io.FilterInputStream.read	4676	dwarf.liar.trust
Invokes method java.io.BufferedInputStream.read	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method java.io.BufferedInputStream.close	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method java.lang.String.getBytes	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method java.io.FileOutputStream.write	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method java.io.BufferedInputStream.close	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method java.io.FilterOutputStream.close	4676	dwarf.liar.trust
Invokes method android.app.ActivityThread.currentActivityThread	4676	dwarf.liar.trust
Acesses field android.app.ActivityThread.mPackages	4676	dwarf.liar.trust
Invokes method java.lang.reflect.Field.get	4676	dwarf.liar.trust
Invokes method java.lang.Object.getClass	4676	dwarf.liar.trust
Invokes method java.lang.ref.Reference.get	4676	dwarf.liar.trust
Invokes method java.lang.ref.Reference.get	4676	dwarf.liar.trust
Acesses field android.app.LoadedApk.mClassLoader	4676	dwarf.liar.trust
Invokes method java.lang.reflect.Field.get	4676	dwarf.liar.trust
Acesses field android.app.LoadedApk.mClassLoader	4676	dwarf.liar.trust

dwarf.liar.trust
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4676

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads