cerberus | 92c9819efea87088865bea931870dd66fd58bfa940c80c2bb63a9601ba8d92cf

Analysis

max time kernel
3040707s
max time network
149s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
25-12-2023 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08a3c95c6cb6e779c295ada6f07afa6d.apk
Size

3.9MB
MD5

08a3c95c6cb6e779c295ada6f07afa6d
SHA1

49e42437bded58e4ed7533144775cf43e7eaf7d9
SHA256

92c9819efea87088865bea931870dd66fd58bfa940c80c2bb63a9601ba8d92cf
SHA512

c7224f362292af44fe728381eb66cb65a60cf13a22ac853718beb049469acea17fb94f31c0c3fb632122875d3e66bfb9a370b36cd05ecf3649a4b293a5cedcc2
SSDEEP

98304:nK7CrwRTd7dK7wWZcbwuDKVdj1YoZVpeT8eQvwzpERz32L:nK7CrWTdZXNAdjioZVUcE83u

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://178.18.251.169

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hover.modify.search
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hover.modify.search

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4227	hover.modify.search

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/hover.modify.search/app_DynamicOptDex/Pd.json	4227	hover.modify.search
/data/user/0/hover.modify.search/app_DynamicOptDex/Pd.json	4253	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hover.modify.search/app_DynamicOptDex/Pd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hover.modify.search/app_DynamicOptDex/oat/x86/Pd.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/hover.modify.search/app_DynamicOptDex/Pd.json	4227	hover.modify.search

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	hover.modify.search

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	hover.modify.search

hover.modify.search
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4227
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/hover.modify.search/app_DynamicOptDex/Pd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/hover.modify.search/app_DynamicOptDex/oat/x86/Pd.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4253

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hover.modify.search/app_DynamicOptDex/Pd.json

Filesize
744KB

MD5
bf8a3656e8ac2ec64bed5dc650c41e8c

SHA1
3c5342160cb190f09693b3334cc221058592cd6b

SHA256
25ac851deb1daa7ac25145d0d77c08a14b5b75d545a14e26b2dee35e7a14f6b3

SHA512
884c5a278547ae3ff08081b5038eaa31a047d756b455c866a391c523b1e170549b0412cae268ba208bad74469de83b2d652d675478af3b826a2b234d7aadcf80

Download Submit
/data/data/hover.modify.search/app_DynamicOptDex/Pd.json

Filesize
744KB

MD5
3f720223fc38331498f66397271a83aa

SHA1
4cab157d64b7bb58beb8f5ac1481b802aafd0329

SHA256
59ae9285529ec8818bee510bdf9fc23a5b520628eedb5608a0097d13584d31b3

SHA512
395426f4ccda4750032585132d1ce6cce0c1bf44766d51c6393b2f159fa287dc53a9496db426cfc74a5b2281b6c3ebb5bf352ce608bb25aa26d2cff344ca8f72

Download Submit
/data/data/hover.modify.search/app_DynamicOptDex/oat/Pd.json.cur.prof

Filesize
891B

MD5
47c3522dfd2a86bbd202e422fce61eb8

SHA1
929cb9c89656871b87830e787efcf6252cd87c25

SHA256
04a7f0afe8a685f9809bad38cd885c3a3d6f4dd78c21e512da70e01baa0c818c

SHA512
6ddcd8286c66c624471914352ac54c7b68da03c7af6a15efcfc34a82fa26b4c5494e1bf1ebb3cd6e51f0c1fbb5f3022ea62093ef8f75b96f3495d78c0a434fc6

Download Submit
/data/user/0/hover.modify.search/app_DynamicOptDex/Pd.json

Filesize
744KB

MD5
d2b78b1ab1242b9cca1f60e985ae2bd7

SHA1
829e5b0447cf2c82921f9971502e063598d1a02c

SHA256
92becefb61055b7873df938b3f7006b65dc3cd37bfed7fbe7de077c38bb07c2d

SHA512
5308828adc83324f0f5d40fa98df2a3af6b51020c8a6f1014e3d1486bf1f44fee0c6ec5cae38df13435b81b89a6426ce887d72498f889740dafdd71fd095f003

Download Submit