cerberus | d87b4772634f8d486477032b639272a774e72081cb1c5a063c339afcf5a24223

Analysis

max time kernel
3148807s
max time network
156s
platform
android_x64
resource
android-x64-20220621-en
submitted
01-07-2022 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0554a9f413a705a2d74a0e4e4855654de5b4c6e78358be3813108cdb555ce566.apk
Size

1.4MB
MD5

d859b12a2aa1f1171ec458aa344486d9
SHA1

44ad9264bbaf8b29a7cac092a7710c34d115a4b7
SHA256

0554a9f413a705a2d74a0e4e4855654de5b4c6e78358be3813108cdb555ce566
SHA512

75b2a778df0353d44b574e514345721f5b86dd38baa2e91c111b4b7442dde9f86dc8a66e902c86bd492b8cd43ffb70898e88fd4d37e6e50ad77cd0a638eae9c7

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

https://adanademirspor.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.debris.please

ioc pid process

/data/user/0/com.debris.please/app_DynamicOptDex/LHKf.json 5867 com.debris.please
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

com.debris.please

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.debris.please

ioc	pid	process
/data/user/0/com.debris.please/app_DynamicOptDex/LHKf.json	5867	com.debris.please

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.debris.please

com.debris.please
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:5867

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.debris.please/app_DynamicOptDex/LHKf.json
Filesize
64KB

MD5
a6759fca0674902ce9debca7e3f104a7

SHA1
c0ab6056c9633cd7bb9566bf4e4fc75c5dfa2a1d

SHA256
6d3aba124d4d8dfc571edf2208e7a1c5cce221d468e8d69744dc048cdd1215ae

SHA512
316699bfa9fb8e1fc273ca19c5ead52ef3602822c541708e3e3431d1b6d84039b9d7dab86bbc5093afdec7c3aaffd5016ba83ab672cfce3d857a3381172f60aa

Download Submit
/data/user/0/com.debris.please/app_DynamicOptDex/LHKf.json
Filesize
124KB

MD5
216261a27a3a8661d05d651cfa4906cf

SHA1
656d79c9c7096455b9476fe6d194f539c1ef5164

SHA256
d22a5077382786176e4b9a9b9d64717ec13c897562842a61624b4b3796efe7de

SHA512
2393beab1f0f287cb7a48a3e5d415cf2c8aae95574b96a55f9b7a5e4554a4926ce6c612ac37b310ef959de7dd41511c61fd4220ead17eb8a17916c1d97cdb9fa

Download Submit
/data/user/0/com.debris.please/app_DynamicOptDex/oat/LHKf.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.debris.please/app_webview/.com.google.Chrome.zznwxx
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.debris.please/app_webview/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.debris.please/app_webview/GPUCache/index-dir/temp-index
Filesize
96B

MD5
a56f42e14dc5145bf5bde2557fa14863

SHA1
8346af7c4c1cdbb5c87341b7114657357120b1b6

SHA256
0e89cad3f9f030138e503630eca18a64e534fc96d18ad41639725212d77db790

SHA512
5b0f2cee470014a5cdbb5683f4fb6327bd72ed56cd2db29c814401bfb749339e40c31ae263981e316dc8f7fe814511a20cd4fc5960e0e9a394937acf9f23ce4e

Download Submit
/data/user/0/com.debris.please/app_webview/Web Data
Filesize
112KB

MD5
b663831f8cc130493476d94f2d7a5330

SHA1
043a1956ab8e40821d67043f8a9110a8eb36fb93

SHA256
c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

SHA512
e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

Download Submit
/data/user/0/com.debris.please/app_webview/Web Data-journal
Filesize
1KB

MD5
1be128fb3c7923b4dbaaedfb6ea0ca73

SHA1
15a71b5ec01c7271279d10ab13628df206551398

SHA256
de23ae3b3b9b7e413c3f9edfb0b6ec5e725fbf880f55bbf5e8f3d3eeb86e9731

SHA512
1e4197ea0862832ac179a23dc6ebbd549ccf18cbc81ec428216b2226638fa44f568bab423a5c729e12edf2ff1205fffe655b538d4d776aff02f5f8d47755705e

Download Submit
/data/user/0/com.debris.please/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.debris.please/app_webview/metrics_guid
Filesize
36B

MD5
16dcd2dfe53fccb82d1bb9318d728889

SHA1
24025a6af1afb4c86e37a09b61e01187b999c10f

SHA256
0b79e2c8483c80ed9ab1754c7265d913e816a2196c64b2e9b2e89820525c7aa5

SHA512
b4422f56d8e69009d5f707b6d6e03d9a32090922c618f5fcc3d0c1d0bcee3989f6df2fb2c269293a7f34b4494232a25996d13b246a8e19f3977d32546f1179b4

Download Submit
/data/user/0/com.debris.please/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.debris.please/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.debris.please/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.debris.please/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
7be78e6eeffc2b197e637e7c704f553d

SHA1
21c7d9f53024523a3dc2622e7e73d1ef91c66f35

SHA256
4c6ecb5e8b64c939fbe7a51ffc7d4b042c3f45ee5ea1f198024ac23cf8c4d726

SHA512
68d625cb494fda5c8233c3dbae176cb77aab7c02103eb3f2cf6fbf834bf5c201b5086272f7168e5042013e540dd48c19a5ff7aea96bfc83025ad9d513c98927d

Download Submit
/data/user/0/com.debris.please/cache/org.chromium.android_webview/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.debris.please/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
79d95267107449fc92d0f00968032300

SHA1
d6a63705c2cd2eb515d3c4339022856a97a761c2

SHA256
48ecca8c6e71fdf9f5db5b70443d7be362cdbbb76c9816bde9c2aad655a11159

SHA512
f27fe93748cc68332d335aab497f08df91821d4886df1371467a5cff0679bb6c4329a68fa9dd836b0e7f058cc3609816c10479c4aad3e18ad278a6765db06cb8

Download Submit
/data/user/0/com.debris.please/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
6ef709b8536878951e87c29a1518fc2b

SHA1
24376c70b00152501b3d98df61fa7db435339172

SHA256
10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

SHA512
96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads