cerberus | 0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a

Analysis

max time kernel
1877707s
max time network
115s
platform
android_x64
resource
android-x64-arm64-20230621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
submitted
19/07/2023, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a.apk
Size

2.0MB
MD5

a52be43e4af45b7be6bf4d6d583391a1
SHA1

df9f83d5f848cfb6bd707815a99d4f49f25f5e01
SHA256

0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a
SHA512

f177d1c006258ac8bd765fe7f2f42408a0c54c1999d83bab144c46242fd4cf6f507a94fba21c979601d902572650d8bd172e909056096fb27eae52cc4e160190
SSDEEP

49152:y/T83mmUl7iu+/ewEGkaozjEBQXtMHBXlVNO2uljajlZlBAa5vnP8AjhcC3BcQr:GTAmflB+/UHaozjEBQX+HBXlVNO2ulux

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

http://84.32.188.52

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bulk.deal
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bulk.deal

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.bulk.deal

Loads dropped Dex/Jar 9 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json	4378	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4378	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4378	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4378	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4378	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4378	com.bulk.deal
/data/data/com.bulk.deal/app_apk/system.apk	4378	com.bulk.deal
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json]	4378	com.bulk.deal
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json]	4378	com.bulk.deal

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.bulk.deal

com.bulk.deal
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4378

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/data/com.bulk.deal/app_apk/system.apk

Filesize
316KB

MD5
69b3ca57adef18f47b71ce651769abf4

SHA1
7204f2b55b577cadc557a4074c29831e313662d6

SHA256
26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

SHA512
22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

Download Submit
/data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json

Filesize
63KB

MD5
109c3b3d6b04af76150c241a43fbcf43

SHA1
c943c67b4f4c0165c7f09346f2eda9037f209fd3

SHA256
ec74cd22f84cac18cfb9d0664681539883b744724d70d28ebeceef928ea95819

SHA512
9b9765bd4b27b015482a9d49f9ad7c740c63f5f2ce21ea7c85320aa26ca0f2cef66de18f43725a92fffc50407a9d242d1d89fd231780a9570638bbe537f1cca9

Download Submit
/data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json

Filesize
124KB

MD5
182b8c1c0348e8569c5618a3b3b9031e

SHA1
7fe51bd7f2e7112d8da624a312f440b74fd17f65

SHA256
27a5cf4d4ff73a1d24148668d875778c0717eefe4ee81dbcbdca6591fe38e725

SHA512
7ac30e5cd24be6e4fb5aece5208980ffcd874cc0f2f9035fd35c94ec57fb2951ff64ada4feb72c9381657acd1e48168b19694bd8bbca610596a0dfea66751b10

Download Submit
/data/user/0/com.bulk.deal/app_apk/system.apk

Filesize
346KB

MD5
0f0b849a407e63fbfd6ab212b89b0177

SHA1
a9c859da13fbf6add0f3a3ccf6a2d46ced8695d3

SHA256
8941c02d6dd5bc5cbff919c93a3642498e07991e6b8cd3205df9950c764dda95

SHA512
8ab86843acf4a685211ab3ba8079cc5b8b4f2ab2127096a8c3afe34c99358faee967cb68fd3b8c69cb09a76f2302396bb0c6ab5fba7e81ced500061ff239b99b

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
86286f5f41a898ee8916ad87c8292683

SHA1
e7352512ac537da9eb1d86ab82458d3972bb8b9d

SHA256
acdd4fbb3111da6ae2e9ccfecd0041e443f212a57323d291185afdcc4d208379

SHA512
7a549fa449e39cdccac0ff5ab8a038a838cb0f6aee83c23b0e313e9d293c42265a4684d1302453dddaf52b184a5c2d11bf853244d181061926be4895fb84b48d

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.bulk.deal/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
961333a191011e2399c4512db67a9fba

SHA1
d755f2317109a24eb3c6495fe39ea85bd651352f

SHA256
b9413d5d30eef9a732b67bd1d69b0468f1f288c3ec985c09aae1ae8ec45d3ae2

SHA512
4d7c6dd1295f3c37865078f9f574f0987f08d0650b4f991a25d28383feb8dade5a825ae1bfb1a267b471ef163508f9181864d77aba8245284cc2c366af9f3c54

Download Submit
/data/user/0/com.bulk.deal/app_webview/webview_data.lock

Filesize
19B

MD5
13a5bdc242389ff08f1836849551498d

SHA1
b2a3eb67ef37e6809a9301f8ebbce9760404b1de

SHA256
9e9e7bdf47eff7a57b2cf65af65cf0f00c930ade037df7849cce5a0b61f88a56

SHA512
bb68d845cccc00205fd45805278266ff7b5e4bcc662e91e94ba2710509a611d05eb5c9209256da3db127d5a6845b1ffd6b2ce83cbc930a8b609b4ca280ef8d9f

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
918a5d6328ec6ede01d3c016763e1286

SHA1
ac8fa467d34ddf06ca93db094dca3e73d04d507a

SHA256
715affab7f95d2b6b2bb67a4eaf1248fc05211c5f620d4a98ac022f88e14f00f

SHA512
e55dec718f9631a900ca3636bf5d391e43c2cdc618aa6b71e75b8af9b0ac49371eaac3f6aef0bf564a3a83e505a6cab1ede449093781c19d91d23784389c58ab

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
00a60394c378025f10c06a2905f072e2

SHA1
01a0cef442a8e5abd6a903464b01b91079e69fa8

SHA256
11f3d7ba86086e5e3c4bd04deddee9b376103f92fbfd495c17ce40b74e20024a

SHA512
203ed3564a919f27cbc2b75a0b5f81a4f25921ffed783a42ca824cc7d511b25bece3128e8de20f60ff28702b8eeff7fe6b88e8c6fb71fe6b096dafe22c9a50f7

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
952ee99243243ac0476f81011e9318f7

SHA1
854ddbca92fb256901e37648ede08b65e14c1c54

SHA256
8b372b077bf0363e63db923daa123a06bef0adfa55fa1ea0cd649b18dcffa489

SHA512
6daf62c57083d5ab6be72cf4e02cb6e79ef696ea2a0808afa3b5d15844d1638f54a59dda39138a3dc88f2bf57e98a29cdc7aca77fc2fabcb6da884b31289e99c

Download Submit
/data/user/0/com.bulk.deal/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.bulk.deal/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.bulk.deal/shared_prefs/settings.xml

Filesize
116B

MD5
d238bcaede8d9fc88b09c0e7fa6248f3

SHA1
7dc3c46230aeff7499e958a777a15ba65d483933

SHA256
44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1

SHA512
ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52

Download Submit
/data/user/0/com.bulk.deal/shared_prefs/settings.xml

Filesize
163B

MD5
95f6cf275d56aef2102b62828f7034c0

SHA1
8117a0e4daf60ee6edf88e6992c764680be59890

SHA256
5dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96

SHA512
6dd12b3f5091eea21604e412748d14e48f77ce03982768cfad754bd581a024b6ccb3e99ed094b4ac27493ac225c99504f6d55b215db2e9e11f1df234d86925fe

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json]

Filesize
124KB

MD5
182b8c1c0348e8569c5618a3b3b9031e

SHA1
7fe51bd7f2e7112d8da624a312f440b74fd17f65

SHA256
27a5cf4d4ff73a1d24148668d875778c0717eefe4ee81dbcbdca6591fe38e725

SHA512
7ac30e5cd24be6e4fb5aece5208980ffcd874cc0f2f9035fd35c94ec57fb2951ff64ada4feb72c9381657acd1e48168b19694bd8bbca610596a0dfea66751b10

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bulk.deal/app_DynamicOptDex/MGgiJN.json]

Filesize
124KB

MD5
182b8c1c0348e8569c5618a3b3b9031e

SHA1
7fe51bd7f2e7112d8da624a312f440b74fd17f65

SHA256
27a5cf4d4ff73a1d24148668d875778c0717eefe4ee81dbcbdca6591fe38e725

SHA512
7ac30e5cd24be6e4fb5aece5208980ffcd874cc0f2f9035fd35c94ec57fb2951ff64ada4feb72c9381657acd1e48168b19694bd8bbca610596a0dfea66751b10

Download Submit