cerberus | 4cce91d4af718275803a9423465bf8c335205b2f0a3b84fbf253c55b5da17c76

Analysis

max time kernel
3843916s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
21-05-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cce91d4af718275803a9423465bf8c335205b2f0a3b84fbf253c55b5da17c76.apk
Size

1.8MB
MD5

28e33d3564f8e222d503a67bc89e6289
SHA1

cbae48ff8f98ac6d43022648135b69a6c208ed2d
SHA256

4cce91d4af718275803a9423465bf8c335205b2f0a3b84fbf253c55b5da17c76
SHA512

38dc9abdcd81f2e4c79e8443384bac1f2c01d1b3eee9a7a78cd280772dac1746da9b3f863a97f17f2a2a14d71b87a71c7f0f953c2998be8f7d5fe750fa551ece

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

http://hatefraud.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

afe.kpjmzap.frm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	afe.kpjmzap.frm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	afe.kpjmzap.frm

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

afe.kpjmzap.frm

ioc	pid	process
/data/user/0/afe.kpjmzap.frm/app_DynamicOptDex/lXru.json	6992	afe.kpjmzap.frm
/data/user/0/afe.kpjmzap.frm/app_DynamicOptDex/lXru.json	6992	afe.kpjmzap.frm

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

afe.kpjmzap.frm

description ioc process

Framework API call android.hardware.SensorManager.registerListener afe.kpjmzap.frm

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	afe.kpjmzap.frm

afe.kpjmzap.frm
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/afe.kpjmzap.frm/app_DynamicOptDex/lXru.json
Filesize
618KB

MD5
dfcb11cb7f60a0d6ce948b0c84023df5

SHA1
0e3abc62d9e5356cf1155c871ca2a6b0959811b0

SHA256
ab50e7b0d2c71b989fa9da99c43da10d21832115932504c0691136a84af2b6a9

SHA512
e2f51af695b009491f69e3542f58640143805e5683e82b30e9463fe698daff85ef1e1a2960dca36dbbeeea20ca731ad55ccc2de3dbd529452d766725ac449a89

Download Submit
/data/user/0/afe.kpjmzap.frm/app_DynamicOptDex/lXru.json
Filesize
618KB

MD5
f9ff132b4863f30d789d589829ed5486

SHA1
c039054afd9579a0bee14180b48ad34066cc9347

SHA256
4bad9c1485462730f9bc896b07c3f88022f348af4963b53acfb7ae9e2dd10e3b

SHA512
ecf1b97a232eddc7f1c21b5807fe8331e43a64b495a34ac5bf27e3458cb64aac4bfd00d5f0c0ffe67b3ff0bf0d5c2e71674e1518b2d1e63844c9c4c0bf3bccea

Download Submit
/data/user/0/afe.kpjmzap.frm/app_DynamicOptDex/lXru.json
Filesize
618KB

MD5
f9ff132b4863f30d789d589829ed5486

SHA1
c039054afd9579a0bee14180b48ad34066cc9347

SHA256
4bad9c1485462730f9bc896b07c3f88022f348af4963b53acfb7ae9e2dd10e3b

SHA512
ecf1b97a232eddc7f1c21b5807fe8331e43a64b495a34ac5bf27e3458cb64aac4bfd00d5f0c0ffe67b3ff0bf0d5c2e71674e1518b2d1e63844c9c4c0bf3bccea

Download Submit
/data/user/0/afe.kpjmzap.frm/app_DynamicOptDex/oat/lXru.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/.com.google.Chrome.73MkJv
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/Default/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/Default/GPUCache/index-dir/temp-index
Filesize
96B

MD5
98662f81335b1e5d95849f7bc4a4c647

SHA1
0b539aa46080dd95f3109524683f5032e194c9bd

SHA256
b803890b7dd6b4ccf2cdf315462b705d7f2d2cdc4407c4576e50873ba7be8ab5

SHA512
a20ad358210af11b354f7ed227eb21df03052ff69cee6badffeb95f47340cc8810216d383cf5f781d89fcdb6f26bbfa2b753af7d835dca830115b39112170801

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/Default/Web Data
Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/Default/Web Data-journal
Filesize
2KB

MD5
ac204924b4bffc84168829c5408b0b0c

SHA1
91d76fd96212982f802282c8c8a832973a14423e

SHA256
f76bd3d2e303ad00ee72ce9d9d938d5c3e66c00b887efeba587ff2f3202b37c2

SHA512
388b12b216c8178a9a0f97dd06665ab4a0cbfc8ce7114baa7e7e7037658ca9aee33f6acdb8b365c56e13dbb4e7c202cd271619e58e6a75111d3462ba2da7d10f

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/afe.kpjmzap.frm/app_webview/webview_data.lock
Filesize
21B

MD5
c1bcd1b090b35150f5422dba1f441870

SHA1
0f6f5281f223f832c465c569bf4a4e7437f61552

SHA256
04e7bfd55b411e77dcb0a9ccb40a44b20c8e3d255d04fccde95af7a09742c171

SHA512
4c789efabe9393f655d986f497fe9b77fdff5ca5c75903f8f0ca334f36a2c5f5d89b0850639550b59f6dbe108d5371c2cf6a936b6da83367742487bc371297d5

Download Submit
/data/user/0/afe.kpjmzap.frm/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
ddb09dfb407e04659d64d80f91aacfdb

SHA1
92b3df1c0e9a17af6a0b63bc1c6f09391479dabe

SHA256
18d5f07041040ca64fc6274178967ee290670f4d3c49361c8375ddc292c18b6e

SHA512
7917f721f87ca83e81ad444fadb7cec8f5c5e48321739db448104911f1fedbccd72bb74ff744df19aedcf2b2f9455a3878c1384305804b6acaf97e18be08153c

Download Submit
/data/user/0/afe.kpjmzap.frm/cache/WebView/Default/HTTP Cache/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/afe.kpjmzap.frm/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
68834121ef727828d58ba0615f789530

SHA1
dc32ed9fe7e2e68249b165d62bf2ab986d67b24a

SHA256
906a9f1fa63d0916bdb8c2b5683e76b3093c7875f145426dd9b13cfbd912e6af

SHA512
2d8a728736d9af89daccfcbcc46ab608c706a5c5cd6eed6bb05075a4f582e7c7a30fd224fb081db474cb1b37936ff19858410053383a1ad9c4a9553192684ad5

Download Submit
/data/user/0/afe.kpjmzap.frm/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/afe.kpjmzap.frm/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
Filesize
96B

MD5
68834121ef727828d58ba0615f789530

SHA1
dc32ed9fe7e2e68249b165d62bf2ab986d67b24a

SHA256
906a9f1fa63d0916bdb8c2b5683e76b3093c7875f145426dd9b13cfbd912e6af

SHA512
2d8a728736d9af89daccfcbcc46ab608c706a5c5cd6eed6bb05075a4f582e7c7a30fd224fb081db474cb1b37936ff19858410053383a1ad9c4a9553192684ad5

Download Submit
/data/user/0/afe.kpjmzap.frm/cache/WebView/font_unique_name_table.pb
Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/afe.kpjmzap.frm/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit