cerberus | d51af4c716bf7980c2e72f871356a68f86bfe276d82beaf0e2dea78c9584929a

Analysis

max time kernel
784354s
max time network
167s
platform
android_x64
resource
android-x64-20230824-en
resource tags

androidarch:x64arch:x86image:android-x64-20230824-enlocale:en-usos:android-10-x64system
submitted
25/08/2023, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d51af4c716bf7980c2e72f871356a68f86bfe276d82beaf0e2dea78c9584929a.apk
Size

2.1MB
MD5

a976a44e938fe417f11d9cf31dd713b3
SHA1

61af018d0cfce1742234fdd3313825c61cb6671f
SHA256

d51af4c716bf7980c2e72f871356a68f86bfe276d82beaf0e2dea78c9584929a
SHA512

f2670e4745f6f8b1aa66d941627ae171e77162bc9b702498a655854ea2e3eefdd9922d7f8ad9309cb34f4e66fd1eaa618360cafc9d9f0c481a9fd06aeb96e38e
SSDEEP

49152:nclZM9iq1rIQvAh0XeOjW/jEXQfNGHRXpfNuSModv2N+1bZz32Mb/DuKNLcQ3Pym:ncbM9iHQvAh0XeOjW/jEXQf8HRXpfNuw

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://5.199.168.237

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.twin.phone
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.twin.phone

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4981	com.twin.phone

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.twin.phone/app_DynamicOptDex/uN.json	4981	com.twin.phone

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.twin.phone

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.twin.phone

com.twin.phone
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Removes a system notification.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4981

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.twin.phone/app_DynamicOptDex/oat/uN.json.cur.prof

Filesize
741B

MD5
262815d605bcc558e816cee5f48f2a85

SHA1
6cd088c5e468d9d184d9492991be8ef97034b3d9

SHA256
e0c93757d70a6352efb691f9d6fca8343ad1ff70f53f96051758c0902cd37e31

SHA512
220cd676521c8cbcd016f90fd5a1e60c99e7436ca7403b572acf7228780b9e032c708019c4f25c174fea49db536f22c4831be5b6df30482d6963f9772b5048bb

Download Submit
/data/data/com.twin.phone/app_DynamicOptDex/uN.json

Filesize
64KB

MD5
d007a5bb21847719a203420d3f8d95b5

SHA1
153a6f88eaa61e455f944fe55b13a6b82c251039

SHA256
4592eb903eb7712b05831ff1dcff2077cff4c896a37251e6237e2a29bf7d21dc

SHA512
371604d06d25a09ac9cd22486e3e26eae3cd53a1e73eeaaa9b75f6628aa0aef57deed364dd9b079b16a9c3bde3ce53f7e42c5c3c0403531568ae2c403ea81394

Download Submit
/data/data/com.twin.phone/app_DynamicOptDex/uN.json

Filesize
64KB

MD5
34586fe182520c3ac2f2113b0d8c87c7

SHA1
b1516e79434c55dd3a1297f2db1945584a6eac9a

SHA256
6b9b88865d56d1d0287458e104ae86cac7eb1c803db5b610f325e9b6ccde509d

SHA512
d02594da4f4e87c5865b94cedffff992d7a69ecc046c6a09222078586a035c3d5f7c0506512ec7e68770f73951085533a9d4fdc412badb508e578356d570f33d

Download Submit
/data/user/0/com.twin.phone/app_DynamicOptDex/uN.json

Filesize
124KB

MD5
cb4e24cea57de42f595068fd09dc48fa

SHA1
2ffcad976f2d390b25d4f266928cf42f1fd51efd

SHA256
381e5a47eb56c6d5191cabb6de42219d3e6bd87b64c0bf5f0f2af0ee2195f91d

SHA512
54b455b74c2f11225e408f549e0cd1987f767bdf00e95b074d6f64ee6662d41fa792c3d8cb220a49258da56d69a237a5ae18de72e4ca3faab9d6a1b295c00d5e

Download Submit