cerberus | 48eb4aca391bc96a97f080f4534e6bd9abb2f29eafb3d388927009b5a102fc92

Analysis

max time kernel
3207578s
max time network
109s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
28-11-2022 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AndroidGuncelleme.apk
Size

2.1MB
MD5

7cb23390212d9a5359fc2931b414399e
SHA1

f9c6b289dfd7aded65d830727944867edbbce1ad
SHA256

48eb4aca391bc96a97f080f4534e6bd9abb2f29eafb3d388927009b5a102fc92
SHA512

457432eacb2f48d757f40d29b5a99cd65a6e6a535dcfbaae34a853afafc87c7699451a03bf00f6a3c1b6eb5e156f443a700108f6c9f70e7ba6eb053cb29717a3
SSDEEP

49152:ijkD8Qbmtu3TqG1PcgYgRspfO5KifO0wnviujng53+mmaIHYoD:ifSqGqGbYWoifOlbjnUOf

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

http://135.181.83.2

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.kidney.puppy

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.kidney.puppy
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kidney.puppy

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.kidney.puppy

ioc	pid	process
/data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json	4654	com.kidney.puppy
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json]	4654	com.kidney.puppy
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json]	4654	com.kidney.puppy

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.kidney.puppy

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.kidney.puppy
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.kidney.puppy

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.kidney.puppy

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.kidney.puppy

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.kidney.puppy

com.kidney.puppy
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4654

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json
Filesize
54KB

MD5
ed177d1008a10bafcb1da3cb66977b7d

SHA1
16cea1e6e56cb76c85d7e38be0d3896ba0922eb4

SHA256
5f2aef5528a68b79a8dda7e4ed586ae0b9b391de4fc02b0e602a2355d80d9c42

SHA512
612c82fe6c0609b2d1c8a1ce7739d2c431fafd23a056dd32217bea84cb35c86799b88eff7ef27db202514a54ce7d07ef8e01415504b790aeb752adcf864c051b

Download Submit
/data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json
Filesize
103KB

MD5
415adb9b4a6c3ec87ebc4b99f19d9524

SHA1
433cae511590c95cacfa4e943cf322e01d44c35c

SHA256
909bd2b8634ce2e02720ddb765dca59ccfb4f274f96b095dc8440d92c5dc337e

SHA512
212b146d5c6c9cace7034ce96c2f519beb5579550a8bdf9579b736303bd3697bf7efeb606ebedd37047f9507dafc3a0f92183931b5628abe76c927a6a785f646

Download Submit
/data/user/0/com.kidney.puppy/app_DynamicOptDex/oat/Qiwffm.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kidney.puppy/app_webview/.com.google.Chrome.qSoNZ6
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Cookies
Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Cookies-journal
Filesize
1KB

MD5
55957d7787866d684397f3deeb7161d4

SHA1
5f1dee1dc4d43d26302edebc7a63509581eec6b0

SHA256
ccf9f9bc490cf23d888b66e5286649635026a6b88b52f596ecc30dc6290f174c

SHA512
6f2c7a68479b5ba53af1d439b1e133c8cf93412497ff351db75df1fdb5cbf45d6a64d6af753674eccbdb95fc5997207f1dd4f98992f47b7bfddb1c1e41055305

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/GPUCache/index-dir/temp-index
Filesize
96B

MD5
33df1042470cb2fd72ef2b96be93c775

SHA1
eb8df5d733ee2c77d28c96795397272e5f77f262

SHA256
93893de26d1becd26d49ad9eed3b8a64636a4e9cbf6f3e661cef9f587a2b4826

SHA512
b4b621c8bbbaa26f9371dfcc8d5de7d01272afe692791c258018fbebf044df86c47d6223fa55d7f5ca8d4179d51965d86417274db9d03e9156bd9da73967e560

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/000001.dbtmp
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/000003.log
Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/LOCK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/LOG
Filesize
128B

MD5
2bafdfac42c72e9a16609c4e70d6892e

SHA1
a747c076ba21ef2ce9f8e51d2c957128c777790b

SHA256
6c6bb0b852ee663aa7787cc7f0ea89b5c5f2d7f6733e46bdd1a4cf80a991210c

SHA512
0c315ac3135ed45fd14357a3fbfc2102b803c75934802561f1a979683db9ba78e87d91e86b4c56e99d6d0bac5d90d67ac51843b6745e648383655a74ff1d3199

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Web Data
Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.kidney.puppy/app_webview/Default/Web Data-journal
Filesize
2KB

MD5
2dce03773e6698c8ccdc99dcfd5dad5e

SHA1
5aeaa371adcc95e6f5a95393ff7ee573b413d839

SHA256
00d94e438e5d653722a357dc91c053f18bd4898bef0896a9abab76215a58633b

SHA512
cd0190a409031c5da4eeed04ef25c1491f449690c649c8386be8fd290525516b199597f0cc82861ccdf2f752efa45df9bb579e4150d281eb43d102dcbb2c0cc3

Download Submit
/data/user/0/com.kidney.puppy/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kidney.puppy/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kidney.puppy/app_webview/webview_data.lock
Filesize
22B

MD5
aadcb076ac35b9467d6fe06f7be882af

SHA1
6ded4c526f351157008d55541502c09c67df1db0

SHA256
860cde813deed3c533c25dcf2da13003a079a8c3d9c312215526ef534332e54e

SHA512
b13dacbfbd1994afb4ffcb9f06c2e46eba459f939572674ec6b11970e14ddfaba438279b0ad573c603f88689eb3f66c72582df11374de0ae34ccc35ac922ecfe

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
c571c2eef219f67d5bdc0b945054c7e0

SHA1
8ae97bb2e36357aaac67e286a696838e01e1ec64

SHA256
7bfecd368ada73f79d2dbecfcd88c305512db025f0d89241c744c45a732b13bf

SHA512
95a2356567f930ea4bfa892d9a7ce6c22c7ae41aa430bc602ec0372357753a0ae3834def62267112c444027bf5476d06dae05d688b44f26c253bac22e16e7ff7

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/08a676c78d1b5fe8_0
Filesize
29KB

MD5
e06d6ea4a4afcf2019e06da97a44795d

SHA1
021bcffa255cba0a1d028b03d02127091ece6c12

SHA256
442aa3aa02e7af8caa5876f3e05af19bff0fb85d4f41700d2a9e3e43827a6e50

SHA512
3b360069d8c29c336d12f853505217e91e43450e29ca783f0812b450125fa24a61db0efbce046cdf0847e66f53030c64805a6dee62cc1da358208ac4d53fe54e

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/180574ed5181a14b_0
Filesize
38KB

MD5
7ee474d11031a4c03f75845b97be2d01

SHA1
de30b5a86a5723389be70c9733b00f26d37844ef

SHA256
96a6b9e9c5946a7cf39df40f4fd5e207e1d0fd60bfa14778d1dd8b36b7ac21f5

SHA512
96a2c4da6a6f5624abfdab1a6a5df385e0034876d7520ec8fc0da3b292b795fd6d69474643d0e921082c94e551b22f909d7b5748ad902152b5c667cc0807dbfb

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
1a642ac22ff9f0fb908c2eb1a84ea1c9

SHA1
d68cc310c3cea9f9968b0e567208eabb664648f8

SHA256
b91418de58f97c7f73ea05bd1d51b4ddef38e2eecb528b0cf8834dfb4091cb4b

SHA512
4ae8da0736255d70025984797cb227c4218ea999b4aea4e43025f4803231ae2f1f26cfab79014ddf2b350465431bee87ead893e54d1a5a481d479c68bcec640b

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
Filesize
96B

MD5
3344f01b20b28dad5edf75c2e7d01258

SHA1
61f2044c498609b11a23ccf460dafe7de9104bcb

SHA256
f249a83e4c6d8df64fa5025bc9f8576f55c9ecc476e5e882378ce859af62975b

SHA512
3eb3a86aed6c4e5a3fe12f6735bada0104a340c6adf49cb10b122ac6935213676d55eeac02e703466e5d01fa8d1323485c1a48779977c3f26d35acd725e5c31d

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/index-dir/temp-index
Filesize
192B

MD5
d3fd7b4918eb0a5d5e46dfe0f9d441e7

SHA1
fd38b744fb70ad80d46cb49c08542572fcee6720

SHA256
8bde2a65d8b4891c400c6d9518806e49118ddff25c6ae80bb9d18147d9c860c5

SHA512
8927392cbb79438d56f178ffbefb4c1781b1f22885879a2efefcd2af5ea57915f647df80b835bf47dedf9a132d50aa6a7fe6226741d2075f8d54b67264cdfc2d

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/index-dir/temp-index
Filesize
192B

MD5
f6b67a164504a8d7c992fbfcc9f0c364

SHA1
2a5faa75ea8d47422a892d6516f10c4b40f11a3e

SHA256
d5b115b03891efff93dd39f73ea5ba0d919549c14375dc3c7c24f68c1d0607b0

SHA512
12fa6ed866bc357f4399b78919ad32c60236689ef08d702eb3438ceb7c3d9c84d37e1d1cd18af2914c3c997af2b03bb0e63fc801236a0797e3d3cb259a9eb47e

Download Submit
/data/user/0/com.kidney.puppy/cache/WebView/font_unique_name_table.pb
Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.kidney.puppy/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.kidney.puppy/shared_prefs/settings.xml
Filesize
116B

MD5
d238bcaede8d9fc88b09c0e7fa6248f3

SHA1
7dc3c46230aeff7499e958a777a15ba65d483933

SHA256
44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1

SHA512
ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52

Download Submit
/data/user/0/com.kidney.puppy/shared_prefs/settings.xml
Filesize
163B

MD5
95f6cf275d56aef2102b62828f7034c0

SHA1
8117a0e4daf60ee6edf88e6992c764680be59890

SHA256
5dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96

SHA512
6dd12b3f5091eea21604e412748d14e48f77ce03982768cfad754bd581a024b6ccb3e99ed094b4ac27493ac225c99504f6d55b215db2e9e11f1df234d86925fe

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json]
Filesize
103KB

MD5
415adb9b4a6c3ec87ebc4b99f19d9524

SHA1
433cae511590c95cacfa4e943cf322e01d44c35c

SHA256
909bd2b8634ce2e02720ddb765dca59ccfb4f274f96b095dc8440d92c5dc337e

SHA512
212b146d5c6c9cace7034ce96c2f519beb5579550a8bdf9579b736303bd3697bf7efeb606ebedd37047f9507dafc3a0f92183931b5628abe76c927a6a785f646

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json]
Filesize
103KB

MD5
415adb9b4a6c3ec87ebc4b99f19d9524

SHA1
433cae511590c95cacfa4e943cf322e01d44c35c

SHA256
909bd2b8634ce2e02720ddb765dca59ccfb4f274f96b095dc8440d92c5dc337e

SHA512
212b146d5c6c9cace7034ce96c2f519beb5579550a8bdf9579b736303bd3697bf7efeb606ebedd37047f9507dafc3a0f92183931b5628abe76c927a6a785f646

Download Submit