cerberus | e8b591d2678800298512295002a936d4850bac44d4f76908b38bb2b616ca2ff6 | Triage™

Analysis

max time kernel
2213309s
platform
android_x86
resource
android-x86-arm
submitted
15/10/2021, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Android_Guncelleme_build_flow.apk
Size 241KB
Sample211015-plm3vabfbp
SHA256 e8b591d2678800298512295002a936d4850bac44d4f76908b38bb2b616ca2ff6
MD5 0c266c61ace74fd4950d361b023f0265
SHA1 63c4d87d4496484375d708e808859e4e511eea36
SHA512 60535f079cdb9dfc62979aacf4dfa6ca3a4117152b7c46cf5946bd3cc93eee49acd513b1cbe471efa9094cf1c73e31576596276681daa498053551cdbf28c405
MD5 SHA1 SHA512

Score

10^/10

cerberus banker evasion infostealer obfuscation rat trojan

Malware Config

Extracted

Family

cerberus

C2

https://hayallerimizdemiyalanoldu.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.vscsals.ogteuluecljooplc

Uses reflection 1 IoCs

description	pid	Process
Invokes method android.content.pm.PackageManager.isInstantApp	4903	com.vscsals.ogteuluecljooplc

com.vscsals.ogteuluecljooplc
1⤵
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses reflection
PID:4903

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads