cerberus | 38b5a7e3e39c72096939eb09e59fa41cd9de2d239e500931a348bc9d4bb2755c | Triage™

Analysis

max time kernel
2513165s
max time network
53s
platform
android_x64
resource
android-x64
submitted
07/12/2021, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38b5a7e3e39c72096939eb09e59fa41cd9de2d239e500931a348bc9d4bb2755c.apk
Size 948KB
Sample211207-t97vdaeeb4
SHA256 38b5a7e3e39c72096939eb09e59fa41cd9de2d239e500931a348bc9d4bb2755c
MD5 b6c1cd0ab72e455a5816bcd3a99e2b06
SHA1 dc4e0ab9b7fa651f1077a4496b42b3b0081e66a8
SHA512 6d8af9940f3a17aa12eafd5c7a5f44efefef5214504e78e53bc5ebe579e2d1a6cdacca55005348175bf783ea3f89682ef77a67fb343bf47aae040b8e671205fc
MD5 SHA1 SHA512

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

C2

http://arm-pay.ru/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/epf.yywrjxjcfzcieixrsblqicj.pxihncgcqryrrufegfffojdtil/app_DynamicOptDex/sQePtB.json	3575	epf.yywrjxjcfzcieixrsblqicj.pxihncgcqryrrufegfffojdtil
/data/user/0/epf.yywrjxjcfzcieixrsblqicj.pxihncgcqryrrufegfffojdtil/app_DynamicOptDex/sQePtB.json	3575	epf.yywrjxjcfzcieixrsblqicj.pxihncgcqryrrufegfffojdtil

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	epf.yywrjxjcfzcieixrsblqicj.pxihncgcqryrrufegfffojdtil

epf.yywrjxjcfzcieixrsblqicj.pxihncgcqryrrufegfffojdtil
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:3575

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads