Malware Analysis Report

2025-01-19 05:18

Sample ID 220602-kwef8seef8
Target BB1146C08E39E704DC50C81BA12169D0EEDE42C38FE9EA5EEDAE74952C75433A.apk
SHA256 bb1146c08e39e704dc50c81ba12169d0eede42c38fe9ea5eedae74952c75433a
Tags
cerberus banker evasion infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bb1146c08e39e704dc50c81ba12169d0eede42c38fe9ea5eedae74952c75433a

Threat Level: Known bad

The file BB1146C08E39E704DC50C81BA12169D0EEDE42C38FE9EA5EEDAE74952C75433A.apk was found to be: Known bad.

Malicious Activity Summary

cerberus banker evasion infostealer rat trojan

Cerberus

Makes use of the framework's Accessibility service.

Loads dropped Dex/Jar

Requests dangerous framework permissions

Removes a system notification.

Listens for changes in the sensor environment (might be used to detect emulation).

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-06-02 08:56

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-02 08:56

Reported

2022-06-02 09:02

Platform

android-x64-20220310-en

Max time kernel

598103s

Max time network

171s

Command Line

com.xwrmnh.qoszdczhgyt

Signatures

Cerberus

banker trojan infostealer evasion rat cerberus

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar N/A N/A

Listens for changes in the sensor environment (might be used to detect emulation).

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Processes

com.xwrmnh.qoszdczhgyt

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 389ee3aca5bf67053f3ea3bb9580fa59
SHA1 986113f66add0927a37c7eb5ee8f25398313ba2c
SHA256 6337ad9bc6fd7c4523a9684382ed4841f453fb6b65c1fbcc5126be4fe8a866ca
SHA512 c312855f55e9b4fc9513250f6a565a157b2cb638ebb9c7a2c23319ece532a580442930bf7579af08c835de54c296642689f96108f2c1d69f9fcf8b6d7771b737

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 9eac7842f81b72657e16ba33e90144a1
SHA1 dc213d3833f485c96b77c9c660d5b85ee9b8586a
SHA256 b73f3b5256bf3173c1454d31c0c4f94efd9e496a640596aa293f62beaab35a0b
SHA512 c4d666b14323378a693a2444f8ab8dd7dee7fb0e57c999495d628a2c29ca2b53ac85119a191bec8cfae3f5cec493b5e74e77b36ce46015dd9ae5845b9f734d90

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/oat/hcwryfjcfr.jar.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/shared_prefs/WebViewChromiumPrefs.xml

MD5 6ef709b8536878951e87c29a1518fc2b
SHA1 24376c70b00152501b3d98df61fa7db435339172
SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
SHA512 96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/metrics_guid

MD5 1d4e27996b0d4262dad95999dc3c8917
SHA1 3cf13ee33aecc807249162001a4545848c9e5b54
SHA256 d5f30410ecefd0d578f49ca24f39bf582fe9d4eaf7821ee765177d0f38d0d117
SHA512 9e8d4af24b0ad18e4fc9499307d1cb33c3d0d7833ea553bf5263e0672238c2e5326fcc2d76f11310c43558fc56ffc626858dac06bf14d25a472a753415dc6d0e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Web Data

MD5 b663831f8cc130493476d94f2d7a5330
SHA1 043a1956ab8e40821d67043f8a9110a8eb36fb93
SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
SHA512 e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Web Data-journal

MD5 68775bd9109116b4279da9c85e3e5255
SHA1 249f04b3c9fdf5831292d131869b479120b3e759
SHA256 03d1c60a180849dff34700cc5c70f55158ba07050c7a759640174de5efcb90a9
SHA512 6443303c1f1c0e337bc80d1867d5106418749b1369ab77c1cd26e5f810e45e4281103d5ae84ae3124eea28738ab69e9cba01bcf7a71184074a7acd8dd61f36cd

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/org.chromium.android_webview/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

MD5 783be8e942369b397a5df47094708fac
SHA1 4c4cb70e615b00143eb715f0644d8afa206eab57
SHA256 ae10a2fac01775c7c16d7c57cbcc9707ab8d3c703c320b127925b9eb8448d480
SHA512 151704847863d4f3bef7e474221df9776ba38326e02d5a08df9811b29f6d6dd4f74c288b3e8e79c25e764ef0fed2d833340a46af886c74af99e4012c173faef1

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/GPUCache/index-dir/temp-index

MD5 e2f06a72a39c72a712e927876f4641e5
SHA1 0ab0a1857378681142203728725713470560bf69
SHA256 56684ea64154c30d91b0587b8bfd069653bbd8b920c2c2a2186643700439846c
SHA512 6f5b43fefc8dfdb57734a00f461c0f45be03a25384ffaf583f49927097678497f79fee020673edf6e811e279c47e53caf528f812d91b3574389d4c2bb28852d2

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/Crashpad/settings.dat

MD5 ef947ed8f12680777037b050ddf2e634
SHA1 3aeefede67a6ffbdf25717294562644c8d4beae8
SHA256 8e39be02314b660feff23a2d2fe4c26d846c25f7c4b7ca8d083b68b6a69f2565
SHA512 8d58e27d8c292b000f56520c9ed88bd490621db039c1b062b415c5f0e81dd69d5c0ed20d44e5ee7cc57ea94694ca5a01eac530daea81937d8acaea433dd1eca3

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/.com.google.Chrome.z1fQdf

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral3

Detonation Overview

Submitted

2022-06-02 08:56

Reported

2022-06-02 09:00

Platform

android-x64-arm64-20220310-en

Max time kernel

597990s

Max time network

165s

Command Line

com.xwrmnh.qoszdczhgyt

Signatures

Cerberus

banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar N/A N/A

Listens for changes in the sensor environment (might be used to detect emulation).

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Processes

com.xwrmnh.qoszdczhgyt

Network

Country Destination Domain Proto
US 1.1.1.1:853 tcp
N/A 224.0.0.251:5353 udp
NL 172.217.168.202:80 play.googleapis.com tcp
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp
NL 216.58.214.14:443 udp
NL 172.217.168.200:443 tcp
US 1.1.1.1:853 tcp

Files

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 389ee3aca5bf67053f3ea3bb9580fa59
SHA1 986113f66add0927a37c7eb5ee8f25398313ba2c
SHA256 6337ad9bc6fd7c4523a9684382ed4841f453fb6b65c1fbcc5126be4fe8a866ca
SHA512 c312855f55e9b4fc9513250f6a565a157b2cb638ebb9c7a2c23319ece532a580442930bf7579af08c835de54c296642689f96108f2c1d69f9fcf8b6d7771b737

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 9eac7842f81b72657e16ba33e90144a1
SHA1 dc213d3833f485c96b77c9c660d5b85ee9b8586a
SHA256 b73f3b5256bf3173c1454d31c0c4f94efd9e496a640596aa293f62beaab35a0b
SHA512 c4d666b14323378a693a2444f8ab8dd7dee7fb0e57c999495d628a2c29ca2b53ac85119a191bec8cfae3f5cec493b5e74e77b36ce46015dd9ae5845b9f734d90

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/oat/hcwryfjcfr.jar.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/shared_prefs/WebViewChromiumPrefs.xml

MD5 97ccd9a2b2063143df56b6937f961ca4
SHA1 5e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA512 86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/webview_data.lock

MD5 1ca5d2e429c3f778566bf180196be306
SHA1 211d54d6dcd922b5abdbfe0025c8b36d6e600e81
SHA256 ad7f6719b195ed239a623085f33e1e032aa8be2aab5bfb101a4af546fc1ab2bb
SHA512 0242d623069a520006af29710bd2d94464ee7a0f9d1cff5c7bbc5c1cc2b68f4283963cd7316ab28abfd9d89f30eb1f4e29c3a534413fcbb61e8ee5009a5acd86

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Default/Web Data

MD5 a48cd9324b1f8754b07f00d863b840f3
SHA1 11c6614775b35a58f440971dfc87c8aaac6d6173
SHA256 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA512 35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Default/Web Data-journal

MD5 6441e7d09508590d346035b68bfed696
SHA1 ba26e7fc8321312fc1df3ce226c9ef1efa72598d
SHA256 d3ea592cb101141e4cdce511c87c3ce67785012cc21d0cd38046fcbecac09ea4
SHA512 77f118acc348ccbe60d6f92a6ac0f85ff0428db413203cf99272595aa69b96ae709bf5fb075724be26331d295750d737cb3b7e9f642d640967cdf484526a9490

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/Default/HTTP Cache/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Default/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Default/GPUCache/index-dir/temp-index

MD5 98c2ccbcaa19ddfd22299c474f61c134
SHA1 13cda3e9d4f4912d1f1ec4b78a713d961c8ab976
SHA256 dc045e7a43eb70d027dc392de56ec74782ba64d6059ab71786449caef3b07824
SHA512 df6b445dc2ac11d8b192018ee8823d7a59ffaa04ab4bc2811341a50413a4fe5a7f7d2415954c921901426110ae3444202264086f08bcaec27be02406bb71d30b

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

MD5 86e62e88e480bde5cbaccc521d5c4b17
SHA1 509b5d23d1ac45184dd75ff669b5d548c46950d6
SHA256 5f0cd0cce691c907de78c68b554b5da78b9684c2257a4f3d2c795fc54e0e7b93
SHA512 cc1760ca49b8976b042406d36bbafb085d3c623c967911e815924df03bef03c558a749fe18e6b03b928e22d8975f0ba8e8c5b39c4d5ca7cdd21dd878cc3916bd

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

MD5 a48032ada0ff57b2eb58dd9d72d56766
SHA1 954e2c84092053ecfbd8b843e7ec4023df08def3
SHA256 f72fad10910ae7975ffa92c05c6e93dcc3feacf4f3eaf9412ab32935308a5386
SHA512 110152e66dec0a90a35b1fdc83342b7ac6118871f6b4a19f19337a9a984fccc934789d2709303464c99cd191b45215f336f3610afd895e092cca273fa32d9332

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/font_unique_name_table.pb

MD5 f080fa2a56ab5479d58063e5ea871447
SHA1 4b3fd57a98916fa5784305b76ba30af26b5253d9
SHA256 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA512 8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

/data/user/0/com.xwrmnh.qoszdczhgyt/cache/WebView/Crashpad/settings.dat

MD5 cbca9d9969376301a181f53d663f62be
SHA1 897556ed56963cc028823d6bb684efa230237a15
SHA256 62e1fa02ed687f7298e53268299c49594753a2dfebf70c01190fe8d8ace9ad5f
SHA512 c23a0da251c1a19139d2f3b3c4f14aa93d9bc666f55cbbf3cebf4a7e0f7efa5dbc7852f73a81dd46df2c2cbf1c91fd5fcedd3d98606baedef62da10d30299036

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/.com.google.Chrome.1btwhE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-02 08:56

Reported

2022-06-02 09:00

Platform

android-x86-arm-20220310-en

Max time kernel

597980s

Max time network

169s

Command Line

com.xwrmnh.qoszdczhgyt

Signatures

Cerberus

banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar N/A N/A
N/A /data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar N/A N/A

Removes a system notification.

evasion
Description Indicator Process Target
Framework service call android.app.INotificationManager.cancelNotificationWithTag N/A N/A

Listens for changes in the sensor environment (might be used to detect emulation).

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Processes

com.xwrmnh.qoszdczhgyt

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/oat/x86/hcwryfjcfr.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
NL 216.58.214.10:80 play.googleapis.com tcp
US 1.1.1.1:53 alt8-mtalk.google.com udp
US 142.250.115.188:5228 alt8-mtalk.google.com tcp
NL 172.217.168.227:80 tcp
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp
US 1.1.1.1:53 android.apis.google.com udp
NL 172.217.168.238:443 android.apis.google.com tcp
US 1.1.1.1:53 lcnpro.net udp
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp

Files

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 389ee3aca5bf67053f3ea3bb9580fa59
SHA1 986113f66add0927a37c7eb5ee8f25398313ba2c
SHA256 6337ad9bc6fd7c4523a9684382ed4841f453fb6b65c1fbcc5126be4fe8a866ca
SHA512 c312855f55e9b4fc9513250f6a565a157b2cb638ebb9c7a2c23319ece532a580442930bf7579af08c835de54c296642689f96108f2c1d69f9fcf8b6d7771b737

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar.x86.flock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/oat/x86/hcwryfjcfr.vdex

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/oat/x86/hcwryfjcfr.odex

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 9eac7842f81b72657e16ba33e90144a1
SHA1 dc213d3833f485c96b77c9c660d5b85ee9b8586a
SHA256 b73f3b5256bf3173c1454d31c0c4f94efd9e496a640596aa293f62beaab35a0b
SHA512 c4d666b14323378a693a2444f8ab8dd7dee7fb0e57c999495d628a2c29ca2b53ac85119a191bec8cfae3f5cec493b5e74e77b36ce46015dd9ae5845b9f734d90

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/hcwryfjcfr.jar

MD5 87746a084c21774ab77668aa202ced3d
SHA1 fe02e4b84dd2aeb70241a2bb08045f4d8807a416
SHA256 3727f85275ee33318b849712d8844a3096284faab7cda26a26615359b36b727d
SHA512 ae78baec75e1a88d8432338de4ebd8fa484098d812daee69dd806936b80aaece5005996c749783418eccf45df285882e8c63a79096c142884046d772b033e5f4

/data/user/0/com.xwrmnh.qoszdczhgyt/app_offline/oat/hcwryfjcfr.jar.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/shared_prefs/WebViewChromiumPrefs.xml

MD5 21223e9184445fe043476484cd8cb1f9
SHA1 2b4813f849121d60ba35eb0889080668bb62c778
SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512 be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Web Data

MD5 dc79f9ce5f3ab5270b33e61119dfc959
SHA1 1844bf222a5144b513dcf2fb50a18c011701c647
SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA512 18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/metrics_guid

MD5 5bacb0be03f5815b82572b3a3dcad787
SHA1 ebab78c1b15bf31d00011ab6fe93b1ce2ac963d2
SHA256 c318d6f13d383674b143178ecc7dbf50919fcf7a097b6793dac9c24187c68d49
SHA512 0a2f537b8b92a98fb5a3be4e01a3208d93dcc05afe176285b8056696eeddb0f0a340c67a17d15ff569ff23830ad1dafe1f67cc12bd6c72c3b0e59682fc80758a

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/Web Data-journal

MD5 274c887cedc0112f4f36de81915dba65
SHA1 6fe71b6d82b663dfdbc2fd6df3e3c8174546ae06
SHA256 0de586251d132b4692ca5c0ff76147806f5d1ed69d1f423b1c6875973b13025b
SHA512 cefe6f8179af4948049ac4cce5a8e8df3758b869b20c713ae5a1034a87100c03a0d00a02de3f97389de3a23e22009485b045ec608e8a4d4a8065ddc2687d25b0

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/GPUCache/index

MD5 93027d42b314432c4216e6cfca48b384
SHA1 43448dd8102979c3926828182579691945eedd4e
SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512 a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

/data/user/0/com.xwrmnh.qoszdczhgyt/app_webview/GPUCache/index-dir/temp-index

MD5 73973d300eb5052f9ef01bd0fa5aaedf
SHA1 ce4db2b6619c486deb6a031f22758ef22b8858f8
SHA256 cd095e0f54653f8edcbd59cb561f9e23b310dc296e2e947416f8c79aee0a3d44
SHA512 1534a7a1008a41c3746c3df9ee2ec26adf45f67bf4f8ba16fd063c3937024a81164c556595738563245bacdfa623367b60a47c104d692107c837e76901b6cb5c