cerberus | 9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0

Analysis

max time kernel
2487922s
max time network
160s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20/12/2023, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0.apk
Size

1.8MB
MD5

725898490828771711e487a67aeb149b
SHA1

b146d8812c79e1cd7b46127efe26aaaaa668b4f2
SHA256

9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0
SHA512

24884a2d340e7ef032c7d0e117624c731dc97e7f1a966d9e059740e962970c8681446f857acc963668ba7d4a46b5e5baec33050a5276778cd0c5b416167bed3b
SSDEEP

49152:mpGJxMZEDaeHWqYaVQdk4Vc5RTSijsztY:wGJe+OeHWqYGQdkThSiAJY

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://teknoasaglik.online

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4999	njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json	4999	njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu
/data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json	4999	njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu

njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4999

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json

Filesize
791KB

MD5
d3dffc453a8761be6d45825a501ad430

SHA1
75d1529a3425c7e49aa67d90f751e3a78b66e359

SHA256
60ef60157445a623636d55e81347a2f0fc322a1c8d98a0421f269330e6401734

SHA512
04c5031249a9db1074f413de9b910236af5d86b5893a7388627e8e72baf05b20ab029c4c215b4aa5e4c4133c64f24527f2d6e246e6fbe11c7c4d1de6956f11e6

Download Submit
/data/data/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json

Filesize
791KB

MD5
b6dc5b2f98e5c26b494e6b5d21900dc7

SHA1
1aeeab5f0e028e536e9f34a9711c27e8c26cbdba

SHA256
058b5927de385c9daa9ef67731dd912e9ae4265b43ca676872e18db9aed3f228

SHA512
8b9928b5ad1a44f8bebe593f0fd12bf46a457a0a2d20afd2b73013528df1f901ca07190a71ab4739afaf63db6c9c39c9f10c277609385c5395c4dfdeebcf351c

Download Submit
/data/data/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/oat/CLgH.json.cur.prof

Filesize
241B

MD5
7d45162f0a7d41234921eafe9239f3d7

SHA1
7b4eee45434891a18feb3472708df328c52c8b67

SHA256
63e7c24b47e0e5dfed18735d35558dbd3a52ed7d7b233b64c96d60fa74f08c66

SHA512
28b697917f55e434ce510fe53e55fa7d0d2dc8b4075d0551a9230d199ed87bddb00656ed75373626578dd03dfe774b3d2a9c77f04d439d709ed4ad9c8fbac2e7

Download Submit