cerberus | bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c

Analysis

max time kernel
2747125s
max time network
156s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
24-12-2023 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c.apk
Size

3.5MB
MD5

6867394eea32e373ced9dc534ddcdf33
SHA1

98dc6dd89137b4d97338f25894074d98c9eb7adb
SHA256

bc9fe51014b45c62ee7bb49bdb6b37c1116d4b9a9a8ce4f90f70376fcff4602c
SHA512

23d6dcaebfb5ee7d6ee92aa325657a521fd6cf445eb1b3bc6714ddbb87e50410751f53d470d622d50da9e55f04d23f669f7af33e1de305d53257c2c5c4a28d30
SSDEEP

98304:X3lFtx240S8vmU23MYC3SNcgSM6G5q3qdDlE3FGP+X:3240S6mU2tC3SGk5uqdDlE3UGX

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://107.175.95.161/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	arrive.sell.bracket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	arrive.sell.bracket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	arrive.sell.bracket

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4982	arrive.sell.bracket

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json	4982	arrive.sell.bracket
/data/user/0/arrive.sell.bracket/app_DynamicOptDex/Jhi.json	4982	arrive.sell.bracket

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	arrive.sell.bracket

arrive.sell.bracket
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4982

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/arrive.sell.bracket/app_DynamicOptDex/Jhi.json

Filesize
713KB

MD5
3ee07ed3e6ac9ef7dbe4932e7e22bb4c

SHA1
6536430f0e415380e56ac46a0bb268d5a65c8456

SHA256
dcc4ac3ad7c343c3286958eeaef10e189ebdefce96a747fd23bd39cf6d18dd67

SHA512
a3b2ba5ad837d6d2408f9917ec5b5b9879c2391ef88ace69a0e3f7773531039dc2b131c9b6d09018025af061e349d23bb86b53f39487d6607878261eb92c95a0

Download Submit
/data/data/arrive.sell.bracket/app_DynamicOptDex/Jhi.json

Filesize
713KB

MD5
482538e6e09691173d0da97458a418a7

SHA1
164a443a985a5e139f9a8ee70ebe4da9e396751b

SHA256
88a43ae219c2e012bb0d351945c4c536e5634faac23e2bccdf88b6cf93030b78

SHA512
90c2dc1422d4407660bce4d95bc4de2d9a8c69e7cbe8d82c3b2c9e59ee30a34eed8feee329120b4592f855f2cf22f5f35e1a88f164591dff47f580e5ebe6169c

Download Submit
/data/data/arrive.sell.bracket/app_DynamicOptDex/oat/Jhi.json.cur.prof

Filesize
900B

MD5
b59a13ae4f92121b0f30e0c294d3a4e7

SHA1
6406a36f61fe150fe8ab2216996764c5ce548433

SHA256
76e84e22e538ad17bacf3123aeb1c0259bdf72628a537f796ace256938fb5197

SHA512
5c0a3cb170898cc9ff41336dc8edadc0308ccc785337ed59866726d47c8b03d78cb41279a4bf671c76d2b054eb48407df3ecfc0762f090479064aa415645e063

Download Submit