Overview

overview

10

Static

static

7

cerberus_sample.apk

android-9-x86

10

cerberus_sample.apk

android-10-x64

10

cerberus_sample.apk

android-11-x64

Analysis

  • max time kernel
    3919457s
  • max time network
    101s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    06/12/2022, 22:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cerberus_sample.apk
  • Size 2.6MB
  • Sample221206-2np2fadh6s
  • SHA256 360cf4e8cbd95c726caf75ae3df66d356dba3a53618dd031e0e20d5a72cfb712
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cerberusbankerevasioninfostealerrattrojan

Malware Config

Extracted

Family

  • cerberus

C2

  • https://herseykulevekale.com

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.proof.liquid
    1⤵
    • Loads dropped Dex/Jar
    PID:4757

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        xeHoN.json
        • Path /data/user/0/com.proof.liquid/app_DynamicOptDex/xeHoN.json
        • Size 118KB
        • SHA256 6ec54325a5eadf21edd9d8dc824fc097a18c29618f980c043e1da28de9ada0df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xeHoN.json
        • Path /data/user/0/com.proof.liquid/app_DynamicOptDex/xeHoN.json
        • Size 118KB
        • SHA256 3a97ad1a04b42b2d1ad24549b6c3b909d9a429cd4114fe91af7b99f483b6ac5a
        • MD5 SHA1 SHA512 SSDEEP
        Download

        xeHoN.json
        • Path /data/user/0/com.proof.liquid/app_DynamicOptDex/xeHoN.json
        • Size 118KB
        • SHA256 3a97ad1a04b42b2d1ad24549b6c3b909d9a429cd4114fe91af7b99f483b6ac5a
        • MD5 SHA1 SHA512 SSDEEP
        Download

        Cookies
        • Path /data/user/0/com.proof.liquid/app_webview/Cookies
        • Size 64KB
        • SHA256 f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cookies-journal
        • Path /data/user/0/com.proof.liquid/app_webview/Cookies-journal
        • Size 1KB
        • SHA256 6c8f7440520734a8a6268001c8523fbd40770e370755074a342047b2ccc21e65
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.proof.liquid/app_webview/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.proof.liquid/app_webview/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 4e72c6656362f9ba38f8bdb6320e99187193d61edc817b3645c262b03ebd2b54
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.proof.liquid/app_webview/Web Data
        • Size 112KB
        • SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.proof.liquid/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 614df70771bdaf172d532a87eef487dfd47d95b249f02af87cf1b4e15cd06101
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.proof.liquid/app_webview/metrics_guid
        • Size 36B
        • SHA256 db11d459a9e0dccdd24958e71e302bd3add367d093b27da01e774dcc33b54ef7
        • MD5 SHA1 SHA512
        Submit Download

        settings.dat
        • Path /data/user/0/com.proof.liquid/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 c5fa53604fa92e01c77ad6b32a131619d01b31e69d0a85fb3dda59e4a594e354
        • MD5 SHA1 SHA512
        Submit Download

        9d4c559e17a87186_0
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/9d4c559e17a87186_0
        • Size 11KB
        • SHA256 161d57f49380f19bee9dd7b0c32c8b32fd39ff9a0bdda444580038be4b33f785
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        index
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 c2b7cdaaaf7504809485398431a974ca459ba3e3473461e1581a4cc9cb95e919
        • MD5 SHA1 SHA512
        Submit Download

        f7d03f364b9296f3_0
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/f7d03f364b9296f3_0
        • Size 58KB
        • SHA256 7fdd5fe4c1312c84bb6e4070137af10cb4f6160efcb3215af4c3e0d08de9a830
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fb9038ce31630217_0
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/fb9038ce31630217_0
        • Size 9KB
        • SHA256 7680c0c7403a085033b9886da313938a92d0d4bf88488f113902e555ac56dbc8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        index
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 96B
        • SHA256 1f3ff2a65e7af512a81a896a3ab2187e08f07d4e14d3fe099f4d46437b68fa65
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.proof.liquid/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 192B
        • SHA256 d8bce7a24ff173074435d139e8141531e78a1bdaa37cc0a2d94a534ebd5a95a3
        • MD5 SHA1 SHA512
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.proof.liquid/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
        • MD5 SHA1 SHA512
        Submit Download

        settings.xml
        • Path /data/user/0/com.proof.liquid/shared_prefs/settings.xml
        • Size 116B
        • SHA256 44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1
        • MD5 SHA1 SHA512
        Submit Download

        settings.xml
        • Path /data/user/0/com.proof.liquid/shared_prefs/settings.xml
        • Size 163B
        • SHA256 5dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96
        • MD5 SHA1 SHA512
        Submit Download