cerberus | 0314ea6ad3cf224a9417ccfd1f8a784a836472094c04a6bc2ffb688313131ecb | Triage™

Analysis

max time kernel
2001596s
max time network
52s
platform
android_x64
resource
android-x64
submitted
13/10/2021, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bildirm.apk
Size 2.5MB
Sample211013-b2z6fsdcan
SHA256 0314ea6ad3cf224a9417ccfd1f8a784a836472094c04a6bc2ffb688313131ecb
MD5 79406a37aa56c8c3b0a6f6eeb48cf5a5
SHA1 118fa2cf82b7ca85cc59eb8986b1537ca5fcd38e
SHA512 9728401f7de75781b6aa36e49a2f2ceb89e913b7d7e27330f7e88841dd782746a4adaa01f66172afa3cf946db4814b243c07d075f3ca03ec8a6739b9b63bd4a6
MD5 SHA1 SHA512

Score

10^/10

cerberus banker evasion infostealer obfuscation rat trojan

Malware Config

Extracted

Family

cerberus

C2

http://161.97.75.127

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.you.because/app_DynamicOptDex/rXWFlP.json	3622	com.you.because
/data/user/0/com.you.because/app_DynamicOptDex/rXWFlP.json	3622	com.you.because
/product/app/webview/webview.apk	3622	com.you.because
/product/app/webview/webview.apk	3622	com.you.because

Uses reflection 2 IoCs

description	pid	Process
Invokes method android.content.Context.bindServiceAsUser	3622	com.you.because
Invokes method android.content.Context.bindServiceAsUser	3622	com.you.because

com.you.because
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3622

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads