cerberus | 044254df954c15ec2931105d863bb4f84c5fa470a49807775d9b5321b30cde6c

Analysis

max time kernel
4008022s
max time network
54s
platform
android_x86
resource
android-x86_arm
submitted
20-04-2021 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sistem_Guncelleme_LM-W-10.07.00.apk
Size

2.9MB
MD5

f858496a35f97e6f6e348bdd9c0d6705
SHA1

207b2bd869656b0a02b2897b62eaa82954632ed3
SHA256

044254df954c15ec2931105d863bb4f84c5fa470a49807775d9b5321b30cde6c
SHA512

6385b377ac0edd42399e27564273addee043a018046c8ab97b2104879a08965cd6ebbc09f21b9814af1228f2049a45a1d7b14c6de630d01168c23862bef0ea47

Score

10^/10

cerberus banker evasion infostealer obfuscation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://45.153.185.116/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

ocean.quantum.leave

pid process

4617 ocean.quantum.leave
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

ocean.quantum.leave

ioc pid process

/data/user/0/ocean.quantum.leave/app_DynamicOptDex/DGnImCk.json 4617 ocean.quantum.leave

pid	process
4617	ocean.quantum.leave

ioc	pid	process
/data/user/0/ocean.quantum.leave/app_DynamicOptDex/DGnImCk.json	4617	ocean.quantum.leave

Uses reflection 27 IoCs

obfuscation

Processes:

ocean.quantum.leave

description	pid	process
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method android.content.res.AssetManager.addAssetPath	4617	ocean.quantum.leave
Invokes method android.app.ContextImpl.getAssets	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method android.content.res.AssetManager.open	4617	ocean.quantum.leave
Invokes method java.io.FilterInputStream.read	4617	ocean.quantum.leave
Invokes method java.io.FilterInputStream.read	4617	ocean.quantum.leave
Invokes method java.io.BufferedInputStream.read	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method java.io.BufferedInputStream.close	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method java.lang.String.getBytes	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method java.io.FileOutputStream.write	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method java.io.BufferedInputStream.close	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method java.io.FilterOutputStream.close	4617	ocean.quantum.leave
Invokes method android.app.ActivityThread.currentActivityThread	4617	ocean.quantum.leave
Acesses field android.app.ActivityThread.mPackages	4617	ocean.quantum.leave
Invokes method java.lang.reflect.Field.get	4617	ocean.quantum.leave
Invokes method java.lang.Object.getClass	4617	ocean.quantum.leave
Invokes method java.lang.ref.Reference.get	4617	ocean.quantum.leave
Invokes method java.lang.ref.Reference.get	4617	ocean.quantum.leave
Acesses field android.app.LoadedApk.mClassLoader	4617	ocean.quantum.leave
Invokes method java.lang.reflect.Field.get	4617	ocean.quantum.leave
Acesses field android.app.LoadedApk.mClassLoader	4617	ocean.quantum.leave

ocean.quantum.leave
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
PID:4617

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads