cerberus | 337bd9c233fb8a3a7e0eda2d33d2665e08e876e97c3066bf9e627a088cb2c2fd | Triage™

Resubmissions

11/04/2026, 11:26

260411-nj9ndsgt8w6

09/12/2021, 16:03

211209-thd3zscef710

Analysis

max time kernel
2683377s
max time network
111s
platform
android_x64
resource
android-x64
submitted
09/12/2021, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hadise_Ifsa_build_obf.apk
Size 2.1MB
Sample211209-thd3zscef7
SHA256 337bd9c233fb8a3a7e0eda2d33d2665e08e876e97c3066bf9e627a088cb2c2fd
MD5 611ae1ffa617ef003887642342394e03
SHA1 e0e2eb968b9cfa93aaef2f48ed21170d4ebc9b0f
SHA512 1f4ae3851aff12cd9e04e8018c8bd5b649fd0f68155820db474a0d3db42ce4a278c5c91ce452ce3fc52d5d7ba247cc0643da166a1ac17461a75901268da863d6
MD5 SHA1 SHA512

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

C2

http://51.81.186.22

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.wood.apart/app_DynamicOptDex/hFqex.json	3664	com.wood.apart
/data/user/0/com.wood.apart/app_DynamicOptDex/hFqex.json	3664	com.wood.apart

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.wood.apart

com.wood.apart
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:3664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads