cerberus | a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81

Resubmissions

10-12-2023 02:26

231210-cwtl6abegr 10

05-12-2023 16:51

231205-vcvdfsce9z 10

Analysis

max time kernel
1368238s
max time network
132s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
10-12-2023 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

1.7MB
MD5

7dd252bc7eb5a0f4af362b30a225b5ed
SHA1

e84bf0c991a22e3dff64231dc1508eeb9d1cbbf9
SHA256

a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81
SHA512

1342e015fc81da1fe16dd0fd32bdba6919517053fdcc45e4857fb85f9d827b040d96a2c3d3c02581a10e2db3b9a0b6d51aa7f233a5ed61474f18f9493c517841
SSDEEP

49152:uUahGKVUaBL2zClijxscjgVunVrgyk/9ygYmhFuONYIc2biMQ7:uUaAKVUaBLfglgExgx9/1hFuONU2biM0

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://162.55.21.189

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.share.seed
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.share.seed

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4243	com.share.seed

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json	4268	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json	4243	com.share.seed

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.share.seed

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.share.seed

com.share.seed
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4243
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
63KB

MD5
e55668923d7c9aec5e9e52268f37b14d

SHA1
0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

SHA256
b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

SHA512
ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

Download Submit
/data/data/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
63KB

MD5
decebb743a92fe0a0acfdeca968c5d6c

SHA1
d32c12030a200b5caf85a07c09dc063ad5431d44

SHA256
a92ea079b1602ca7a43ca2048e16475c2832a1b9b98c9602d30779aff6fb3981

SHA512
434557959be34d19c1c0b28a74d55c75aa44e97bab79fb55c03f66d29ae1856e78395976c27af6f3c1f4bf972753ab950339877ab7bb9c59cbfef4d77f2ad261

Download Submit
/data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof

Filesize
841B

MD5
931784dfd5bb2fc366a7b971c0598f6f

SHA1
e94d874574e42ce17f7b73e9d01d3695db5b7e60

SHA256
2b5905383c72c7a7fef65c56e6529984f7b3b666e5a719a35f15c5e643394976

SHA512
6ab57849edda354364ec401db6f803b9956911e656903e2874dee551fc056b1e9a121ac881110fb9eb14ce6d3dc9bf9a99ca76a0f23d19626816bbcff1d9d338

Download Submit
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
124KB

MD5
02d0a7ebb9a9e83f1ff75fcd631bea91

SHA1
4227f46b3c07a93b585a19fa1b5294ea616abcd6

SHA256
086694c946a8b7407e34734d221148f1c52fe9d0e5a0d680c707a586427c4852

SHA512
3554ba5cdee20b4a252d43ec45540a177c7f5bfdf0febc0c2abe1d48450a0284fe2108a0392765f524840572824a15642fd6c5aeef3221ec16938835651047f5

Download Submit
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
124KB

MD5
bf3a8b20950af2241e402aa6c819bcbf

SHA1
fbe7196d34d9fff857087a88a95df291b02e52c1

SHA256
307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

SHA512
68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

Download Submit