cerberus | 0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a

Analysis

max time kernel
1877481s
max time network
107s
platform
android_x64
resource
android-x64-arm64-20230621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
submitted
19/07/2023, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a.apk
Size

2.0MB
MD5

a52be43e4af45b7be6bf4d6d583391a1
SHA1

df9f83d5f848cfb6bd707815a99d4f49f25f5e01
SHA256

0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a
SHA512

f177d1c006258ac8bd765fe7f2f42408a0c54c1999d83bab144c46242fd4cf6f507a94fba21c979601d902572650d8bd172e909056096fb27eae52cc4e160190
SSDEEP

49152:y/T83mmUl7iu+/ewEGkaozjEBQXtMHBXlVNO2uljajlZlBAa5vnP8AjhcC3BcQr:GTAmflB+/UHaozjEBQX+HBXlVNO2ulux

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

http://84.32.188.52

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bulk.deal
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bulk.deal

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.bulk.deal

Loads dropped Dex/Jar 8 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4432	com.bulk.deal

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.bulk.deal

com.bulk.deal
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json

Filesize
63KB

MD5
109c3b3d6b04af76150c241a43fbcf43

SHA1
c943c67b4f4c0165c7f09346f2eda9037f209fd3

SHA256
ec74cd22f84cac18cfb9d0664681539883b744724d70d28ebeceef928ea95819

SHA512
9b9765bd4b27b015482a9d49f9ad7c740c63f5f2ce21ea7c85320aa26ca0f2cef66de18f43725a92fffc50407a9d242d1d89fd231780a9570638bbe537f1cca9

Download Submit
/data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json

Filesize
124KB

MD5
182b8c1c0348e8569c5618a3b3b9031e

SHA1
7fe51bd7f2e7112d8da624a312f440b74fd17f65

SHA256
27a5cf4d4ff73a1d24148668d875778c0717eefe4ee81dbcbdca6591fe38e725

SHA512
7ac30e5cd24be6e4fb5aece5208980ffcd874cc0f2f9035fd35c94ec57fb2951ff64ada4feb72c9381657acd1e48168b19694bd8bbca610596a0dfea66751b10

Download Submit
/data/user/0/com.bulk.deal/app_apk/system.apk

Filesize
346KB

MD5
0f0b849a407e63fbfd6ab212b89b0177

SHA1
a9c859da13fbf6add0f3a3ccf6a2d46ced8695d3

SHA256
8941c02d6dd5bc5cbff919c93a3642498e07991e6b8cd3205df9950c764dda95

SHA512
8ab86843acf4a685211ab3ba8079cc5b8b4f2ab2127096a8c3afe34c99358faee967cb68fd3b8c69cb09a76f2302396bb0c6ab5fba7e81ced500061ff239b99b

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
db97b2fd32b22f495a6bf28216a1705e

SHA1
03601cfdf4dc14ffabb71d03b392d69dc219621b

SHA256
ba7bb14a6e5563a38588294a5828f8d759d5483a63f528787d0d25860653fad9

SHA512
7b63e4fb7416e47bbd2ac42ad720793d263c71baf988e4ce25896552fe93c1d257ed8abe653f63827a4fb6a5eb50e0377da36aa4014e6254d9feeb226b13c774

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
2b74604cf378578d5d5a2c9aaeb32e37

SHA1
7f9e4ce9c72e4d099adfad9aeb6e2e4e3ac91833

SHA256
f28ccbff0a3c5bc5f51047d527b14abe4349a7f12c04a81ecbaaaa1fbace3052

SHA512
050b7bdec5f02a3e9dc30ed931fddaafeff97f90c9aa03c0d161125c7c7ac31ed668c6cc94a0e367d8f6f191cb67c74ed7dd4e71d43e5f77eea145aa4642447f

Download Submit
/data/user/0/com.bulk.deal/app_webview/webview_data.lock

Filesize
19B

MD5
1596883e2a59ab82f1b13e1e5b660399

SHA1
ba6e379f59d75fa9615654efd3bfc5671ee4b57a

SHA256
facf7b318e23d04e0df60edaa4871fad29ee7d1b6e2ab1884e8f3ea0ff5a0c9f

SHA512
a8986ca13bb4b9e84b2f08aeddc21591db83371f9dd7707da00f63ac746c2ac5c91560d4f4ae4e73815e59d636760b46bf60305758589e2d23e477ac72080783

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
2d9392c69e6e7bdb712703d8861fe870

SHA1
a69a042a4a3f4103bbbef9de7becf823f4f83184

SHA256
f383aa0cf7780c734639a39b51b532341e5d37357cfeef0b04002f6d1dfe6a2a

SHA512
f33cabc2d8d92a7e3ec3b370c5c7405710acbfb2a7911bc78ca199d0d3736612e7b1fcb9797239987ca8ce9452c3b0ec39e682046fe7982daf76b2ea76b4e5a7

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
180cde5d07bc88c1629fab006cb4589f

SHA1
ef070ed4107089dbfad4e05f6506f404c4e360ef

SHA256
6225cfba4965efd8f37b981ba4caead0755ab70ca9af2a02e0f2f61c635963c8

SHA512
ec00eadd9225934b7aee095928ff13a15bf8dd505e5c221f49925889dc10a81901718e74190fadd57a58c7ebb86f4d20db731f384c4573e3a27add23c7ff7de3

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
0aa3aea07b3837120359d8d8aaa9ea03

SHA1
e3ed26171b50cd916d99195a9e1802eb77ff20b7

SHA256
c3d2a3af5ed2b1d5bbea600b986a7ceb4cc5f758ac3d14490cccc19976e50cea

SHA512
1a59c7518bc67614365a4e5013dec1525dd92619cb1b19f35a368d173642b89b600d7ffcf6caa287fefd574c228cef1d1416abec791d90406861f0dc1f025b4f

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.bulk.deal/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.bulk.deal/shared_prefs/settings.xml

Filesize
116B

MD5
d238bcaede8d9fc88b09c0e7fa6248f3

SHA1
7dc3c46230aeff7499e958a777a15ba65d483933

SHA256
44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1

SHA512
ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52

Download Submit
/data/user/0/com.bulk.deal/shared_prefs/settings.xml

Filesize
163B

MD5
95f6cf275d56aef2102b62828f7034c0

SHA1
8117a0e4daf60ee6edf88e6992c764680be59890

SHA256
5dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96

SHA512
6dd12b3f5091eea21604e412748d14e48f77ce03982768cfad754bd581a024b6ccb3e99ed094b4ac27493ac225c99504f6d55b215db2e9e11f1df234d86925fe

Download Submit