cerberus | 8529714de7f726121a5a07c8e9e718828bc3bc198c512139be2ac5183e0bf25e

Analysis

max time kernel
2438884s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20/12/2023, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8529714de7f726121a5a07c8e9e718828bc3bc198c512139be2ac5183e0bf25e.apk
Size 1.9MB
Sample231220-ff96racebk
SHA256 8529714de7f726121a5a07c8e9e718828bc3bc198c512139be2ac5183e0bf25e
MD5 94c1d7c4f1074984711614b0cfda456e
SHA1 8d686ab480c21431d861b36f7219ebc9da1380e1
SHA512 207fbe3b3acf2e9f9b7a3c6cbbf6f5a79f99c0aa73ec82c81964ebb35812402ed7ff920fd92aa533f908d2cde580be75bc85dda53114844c971c36b1899545a5
SSDEEP 24576:nWWMlfZkb9Nlu6lNOSWBRq608KXsO6C9b4RKLyxMNszDxRwzN9Lqm54nOPOw:vUkbE6lNITk4Amvz4NxqmGOPOw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://51.81.86.211

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pattern.pride
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pattern.pride

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4271	com.pattern.pride

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.pattern.pride/app_DynamicOptDex/XnK.json	4271	com.pattern.pride
/data/user/0/com.pattern.pride/app_DynamicOptDex/XnK.json	4296	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pattern.pride/app_DynamicOptDex/XnK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pattern.pride/app_DynamicOptDex/oat/x86/XnK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pattern.pride/app_DynamicOptDex/XnK.json	4271	com.pattern.pride

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pattern.pride

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.pattern.pride

com.pattern.pride
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4271
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pattern.pride/app_DynamicOptDex/XnK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pattern.pride/app_DynamicOptDex/oat/x86/XnK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

XnK.json

Path /data/data/com.pattern.pride/app_DynamicOptDex/XnK.json
Size 124KB
SHA256 a017e477feed9c4c6d74202a384695350881da1bb7ec8e01513ed2c0cbab0820
MD5 82c7377846a68a64a966b4a944a82afa
SHA1 5f7bf4dd662ff4a19755b5a8b1568dc4d28bcbd3
SHA512 111491c98553b8e0fae067cd87499cc986d5bcbbc00ff2b4c8db128495d4ca72ff1f64359d018316ab84f90337cb2535e93e929c6936760f020dd34060df0ef0
SSDEEP 3072:97KsIsyd7xzsHOe6uYIzJa8e1UAN6djsE/j8T:1x2deOivzg8KbS3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnK.json

Path /data/data/com.pattern.pride/app_DynamicOptDex/XnK.json
Size 124KB
SHA256 2a93d62db44439230e26a078fc620c5a10f521211d82990f778168e760ebdfa2
MD5 9ee2ab626b4c7ee49ef52aac954ce0d7
SHA1 17a6c652b06a82f3a408f36a7101418fa5f36ee9
SHA512 0b63993a7f590b320e029a6585dd25513acd6be7a46aa91da35a327103626c6e4bfedfdb5cc7f4b621795cd18531a885a7495a8b08aa833d91b22d1baf82c9e7
SSDEEP 3072:SOlU7LMissSsYqUCe2AFy/M9+HMMBzJynmIyEseq78P+w:LlUvMA/Gr9+HMO9OjyEhZ+w
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnK.json.cur.prof

Path /data/data/com.pattern.pride/app_DynamicOptDex/oat/XnK.json.cur.prof
Size 795B
SHA256 806b0f7575515f8850439e86f8ee94043c5aaa4da187ca3c77a5a10d5719a497
MD5 8b892bbf9da9d64f56c74e9541677820
SHA1 e5a84d934e7437a43cc6f89fef43be0e4e467c05
SHA512 7a560489e31bfbdfcf5ef63b04939394caefa594686abc09f09ac01842629adc679eff93fa6d3758ad9bbc03808a456e6a6c1a34505e546060f0446dbf2043ed
MD5 SHA1 SHA512

Submit Download

XnK.json

Path /data/user/0/com.pattern.pride/app_DynamicOptDex/XnK.json
Size 124KB
SHA256 1055dff2e6b03226fcf89b66756be81ab115a3d99e6ce2d5bcbd1e47d4290b81
MD5 f2d9ca1d557bbcbbee66ec5a19bb87cf
SHA1 16c3164c9f7c5d64c342fac69cc991f9f474b305
SHA512 f5f7a896e70475bae2438fad9eabe7e60fe371c21879d324bbfbdc1ce6634d6429ed01c26c95ce9ff4c635955aadfdb17990bf9ac561a761f0f5886526395da9
SSDEEP 3072:SOlU7LMissSsYqUCe2AFy/M9+HMMBzJynmIybHsKkG+w:LlUvMA/Gr9+HMO9OjyfkG+w
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads