cerberus | bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c

Analysis

max time kernel
2953337s
max time network
156s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24-12-2023 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c.apk
Size

3.5MB
MD5

6867394eea32e373ced9dc534ddcdf33
SHA1

98dc6dd89137b4d97338f25894074d98c9eb7adb
SHA256

bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c
SHA512

23d6dcaebfb5ee7d6ee92aa325657a521fd6cf445eb1b3bc6714ddbb87e50410751f53d470d622d50da9e55f04d23f669f7af33e1de305d53257c2c5c4a28d30
SSDEEP

98304:X3lFtx240S8vmU23MYC3SNcgSM6G5q3qdDlE3FGP+X:3240S6mU2tC3SGk5uqdDlE3UGX

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://107.175.95.161/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	arrive.sell.bracket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	arrive.sell.bracket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	arrive.sell.bracket

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4266	arrive.sell.bracket

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json	4266	arrive.sell.bracket
/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json	4292	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/arrive.sell.bracket/app_DynamicOptDex/oat/x86/Jhi.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json	4266	arrive.sell.bracket

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	arrive.sell.bracket

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	arrive.sell.bracket

arrive.sell.bracket
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4266
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/arrive.sell.bracket/app_DynamicOptDex/oat/x86/Jhi.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/arrive.sell.bracket/app_DynamicOptDex/Jhi.json

Filesize
713KB

MD5
3ee07ed3e6ac9ef7dbe4932e7e22bb4c

SHA1
6536430f0e415380e56ac46a0bb268d5a65c8456

SHA256
dcc4ac3ad7c343c3286958eeaef10e189ebdefce96a747fd23bd39cf6d18dd67

SHA512
a3b2ba5ad837d6d2408f9917ec5b5b9879c2391ef88ace69a0e3f7773531039dc2b131c9b6d09018025af061e349d23bb86b53f39487d6607878261eb92c95a0

Download Submit
/data/data/arrive.sell.bracket/app_DynamicOptDex/Jhi.json

Filesize
713KB

MD5
482538e6e09691173d0da97458a418a7

SHA1
164a443a985a5e139f9a8ee70ebe4da9e396751b

SHA256
88a43ae219c2e012bb0d351945c4c536e5634faac23e2bccdf88b6cf93030b78

SHA512
90c2dc1422d4407660bce4d95bc4de2d9a8c69e7cbe8d82c3b2c9e59ee30a34eed8feee329120b4592f855f2cf22f5f35e1a88f164591dff47f580e5ebe6169c

Download Submit
/data/data/arrive.sell.bracket/app_DynamicOptDex/oat/Jhi.json.cur.prof

Filesize
920B

MD5
862f412dc342edbdbf8d37b79d113861

SHA1
25609af712bace8300595bc053ea0e8ccead129b

SHA256
b7d350f604f31cc2bbabcc8c4b6ac0df4b972685383488aca5ac7ece23df2db9

SHA512
6e0fcb5db8305b4892c3fa979ba9edea772f1618177504b38c044be84bf116c2698892a11474cedd9da22c073da3289ef9d1ae54643d603e899ec138da935edb

Download Submit
/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json

Filesize
713KB

MD5
111e20161de487d36701ebdc74cedae8

SHA1
16f75c53593cd047d4bc490bf1769d190819e4e0

SHA256
e4ec9c3038c7e93eb618543359c3ec16ed79dcebbb33fb396ab344ca33ae459c

SHA512
2cd0753263d175e561d70cae5a12af8ca5b0231dce060492911f6b9d0e41bac78a8fe1735bfff1ee56a10bee83a84e62c3f793ecad54328e6bdd304deb35646f

Download Submit