cerberus | 72947cc5aaeda9164442abb39abba89a977445c3f90d3abf9f07ae1498fffcec

Analysis

max time kernel
4008021s
max time network
142s
platform
android_x86_64
resource
android-x86_64
submitted
20-04-2021 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Androidupdate.apk
Size

2.6MB
MD5

e6122601d0025dce56d420a66b6aadba
SHA1

dae25433a7a016f5fff5610209ff27ba78b33e2d
SHA256

72947cc5aaeda9164442abb39abba89a977445c3f90d3abf9f07ae1498fffcec
SHA512

96f776e932e2a6cdf7865d6c41b8bd112347c98b3f47a2ce3941bb2fb84af5eeca2c9e9923665aa4c5e7b13ad6b2863b20181095da250189f7383471030d76e9

Score

10^/10

cerberus banker evasion infostealer obfuscation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://20.190.192.187/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

fall.hair.prison

pid process

3635 fall.hair.prison

pid	process
3635	fall.hair.prison

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

fall.hair.prison

ioc	pid	process
/data/user/0/fall.hair.prison/app_DynamicOptDex/SBw.json	3635	fall.hair.prison
/data/user/0/fall.hair.prison/app_DynamicOptDex/SBw.json	3635	fall.hair.prison

Tries to add a device administrator. 1 IoCs

Processes:

fall.hair.prison

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN fall.hair.prison

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	fall.hair.prison

Uses reflection 27 IoCs

obfuscation

Processes:

fall.hair.prison

description	pid	process
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method android.content.res.AssetManager.addAssetPath	3635	fall.hair.prison
Invokes method android.app.ContextImpl.getAssets	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method android.content.res.AssetManager.open	3635	fall.hair.prison
Invokes method java.io.FilterInputStream.read	3635	fall.hair.prison
Invokes method java.io.FilterInputStream.read	3635	fall.hair.prison
Invokes method java.io.BufferedInputStream.read	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method java.io.BufferedInputStream.close	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method java.lang.String.getBytes	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method java.io.FileOutputStream.write	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method java.io.BufferedInputStream.close	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method java.io.FilterOutputStream.close	3635	fall.hair.prison
Invokes method android.app.ActivityThread.currentActivityThread	3635	fall.hair.prison
Acesses field android.app.ActivityThread.mPackages	3635	fall.hair.prison
Invokes method java.lang.reflect.Field.get	3635	fall.hair.prison
Invokes method java.lang.Object.getClass	3635	fall.hair.prison
Invokes method java.lang.ref.Reference.get	3635	fall.hair.prison
Invokes method java.lang.ref.Reference.get	3635	fall.hair.prison
Acesses field android.app.LoadedApk.mClassLoader	3635	fall.hair.prison
Invokes method java.lang.reflect.Field.get	3635	fall.hair.prison
Acesses field android.app.LoadedApk.mClassLoader	3635	fall.hair.prison

fall.hair.prison
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Tries to add a device administrator.
- Uses reflection
PID:3635

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads