cerberus | 612122f55d5859458323f874ac961cb46291de4359284feec5bd6181d8b163cd

Analysis

max time kernel
870774s
max time network
162s
platform
android_x64
resource
android-x64-arm64-20230824-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230824-enlocale:en-usos:android-11-x64system
submitted
26/08/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

612122f55d5859458323f874ac961cb46291de4359284feec5bd6181d8b163cd.apk
Size

2.4MB
MD5

8622a39b4380236def5aeedf9071da6c
SHA1

bf5e8049840525019048001f79da4f6cf64deb6c
SHA256

612122f55d5859458323f874ac961cb46291de4359284feec5bd6181d8b163cd
SHA512

f57c877f88c5cee786845ab8d8896222cc6c3549da67d3e9549524e5505e014e9a9e71c63687b1971524380211bb0083adfc0a375b1fed17fd7fda915fb143f5
SSDEEP

49152:TE3nIbuMuSFUM+FlKa/9fU1qpx4WfcX8EA1LlMGgVIoREe8ZqSbc8tk3X0ghbbTf:uIbvuSFUdlKa/9AuncX8EA7WyaEFqSgp

Score

10^/10

cerberus banker evasion infostealer rat trojan

Malware Config

Extracted

Family

cerberus

http://bamosapportodassonparar1726.shop

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.capital.glass
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.capital.glass

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json	4421	com.capital.glass
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json]	4421	com.capital.glass
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json]	4421	com.capital.glass

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.capital.glass

Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.capital.glass

com.capital.glass
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4421

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json

Filesize
59KB

MD5
3f14ad45d6a1730f326dfa415649be7b

SHA1
d5857627d4e22751f1d68eb3458bee20248479d5

SHA256
997753d566e9c27dc3482f8f6966f1f6265100e9bbb073607aabcb25e80ae37c

SHA512
daa1e8b7a09e40c679b9678a14f8a4ddff767a85e2db31c8c0b04bcd0d06d36c1430b66c4d3ea291171da423954a57d6ff4b44ce1e17c9b19d1bec8b7b17796f

Download Submit
/data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json

Filesize
59KB

MD5
aad585b9c555c81dc9d105dc8293d22f

SHA1
9fdcf243370318b6cefe50980e7da8e1d8f3b8c9

SHA256
569b0e5470ccea871fca15fcf30ec3bcdc881956752bf6f025eacccb20313796

SHA512
72d9945ae02be9a8b0c9dbfd2a6c94c3915d0b0bd2becefdfcb5f5f518db825b21ee174d227e83d2da1f31196695db415bf50f44a7130ace7d5044770f8e7130

Download Submit
/data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json

Filesize
116KB

MD5
fe283e9408585871d94c3f88a141aac2

SHA1
92b34b5db5fcf90eebc1fd599ec632055e4f22f5

SHA256
2d2b65e640092dc6ca5bfd2cfa8c6aee0ac973d9d66f6f64d103fbee63982346

SHA512
1822ca2a9f514a9dcb6a30d0af1eba881d027fd20ea7e7f3dc6d720e5f6a0ae5cca0215e2729fd67a4d5e652e0344812ccd514c9264d1d3a4fc0a4895bbaa30e

Download Submit
/data/user/0/com.capital.glass/app_DynamicOptDex/oat/SKSwug.json.cur.prof

Filesize
178B

MD5
d314ebd04d54c04a4093fcdc87e1d1bd

SHA1
93a1cd5372733914f86e498f485d9023be979a8e

SHA256
2ff3facebc712b9d357b9aa2cf0702ee9241db1d5ca47217cf260c750d2c0c25

SHA512
65a481edd6bd694f8c23703b265aff81569b3d94d62feb328ddc63ad27152a85bef8bd8b02696da23c2b68e68303d8694f3c8beb07cc1feb9913701d3cfb4aab

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json]

Filesize
116KB

MD5
fe283e9408585871d94c3f88a141aac2

SHA1
92b34b5db5fcf90eebc1fd599ec632055e4f22f5

SHA256
2d2b65e640092dc6ca5bfd2cfa8c6aee0ac973d9d66f6f64d103fbee63982346

SHA512
1822ca2a9f514a9dcb6a30d0af1eba881d027fd20ea7e7f3dc6d720e5f6a0ae5cca0215e2729fd67a4d5e652e0344812ccd514c9264d1d3a4fc0a4895bbaa30e

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.capital.glass/app_DynamicOptDex/SKSwug.json]

Filesize
116KB

MD5
fe283e9408585871d94c3f88a141aac2

SHA1
92b34b5db5fcf90eebc1fd599ec632055e4f22f5

SHA256
2d2b65e640092dc6ca5bfd2cfa8c6aee0ac973d9d66f6f64d103fbee63982346

SHA512
1822ca2a9f514a9dcb6a30d0af1eba881d027fd20ea7e7f3dc6d720e5f6a0ae5cca0215e2729fd67a4d5e652e0344812ccd514c9264d1d3a4fc0a4895bbaa30e

Download Submit