cerberus | a95070651ed64f60b616110043bb2d37e0b7fb02b42911f8d3535e71d6c4bbf7 | Triage™

Analysis

max time kernel
3383420s
max time network
96s
platform
android_x64
resource
android-x64-arm64
submitted
05/02/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a95070651ed64f60b616110043bb2d37e0b7fb02b42911f8d3535e71d6c4bbf7.apk
Size 131KB
Sample220205-npb93sbbdn
SHA256 a95070651ed64f60b616110043bb2d37e0b7fb02b42911f8d3535e71d6c4bbf7
MD5 149188b836372cd8c9a7cab64333b861
SHA1 4c70e9f168cb3da719ce1c61db077d8d7f1d974a
SHA512 e459f729e09a44fb7addb6413255837948ef41f71f4dc8ea697cb2f5e4185793e122a40590c978f116daff8f24bde9e3525bd5c399b3966b63b5e2de4a47658f
MD5 SHA1 SHA512

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

C2

http://139.162.187.208/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.uhciwzaqmjqfw.jvvogaxaeanoymc

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.uhciwzaqmjqfw.jvvogaxaeanoymc

com.uhciwzaqmjqfw.jvvogaxaeanoymc
1⤵
- Makes use of the framework's Accessibility service.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:5602

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads