cerberus | cf3e16d6328d572cdf4476809e25c52790d77bec8ac1a52a7129485c55a7c6a7

Analysis

max time kernel
3043745s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
25-12-2023 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

183ac21bb70d1e9527de39136d927094.apk
Size

4.0MB
MD5

183ac21bb70d1e9527de39136d927094
SHA1

c654873f2c978fd1538e215a8db6ca847a06fbb0
SHA256

cf3e16d6328d572cdf4476809e25c52790d77bec8ac1a52a7129485c55a7c6a7
SHA512

cc6c3cb1f86d05c5072b3d5bc57af690f2b49ca054e505bc67ce758586076c0d8fecff50e8e7b1c06295fc8637134f6ace6a14570fbbba74d3bbf29da80a6cf4
SSDEEP

98304:kFWGTMw78bjU4Tg3rwk/K1xGbuGV9Nt4DWzpnw+YHq7+ri1:kFWGTMg8bjfsXaxGi09L4DK+LHba

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://193.37.212.83/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	stay.benefit.recall
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	stay.benefit.recall

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4251	stay.benefit.recall

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/stay.benefit.recall/app_DynamicOptDex/Gg.json	4251	stay.benefit.recall
/data/user/0/stay.benefit.recall/app_DynamicOptDex/Gg.json	4277	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/stay.benefit.recall/app_DynamicOptDex/Gg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/stay.benefit.recall/app_DynamicOptDex/oat/x86/Gg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/stay.benefit.recall/app_DynamicOptDex/Gg.json	4251	stay.benefit.recall

Tries to add a device administrator. 1 IoCs

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	stay.benefit.recall

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	stay.benefit.recall

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	stay.benefit.recall

stay.benefit.recall
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Tries to add a device administrator.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4251
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/stay.benefit.recall/app_DynamicOptDex/Gg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/stay.benefit.recall/app_DynamicOptDex/oat/x86/Gg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4277

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/stay.benefit.recall/app_DynamicOptDex/Gg.json

Filesize
632KB

MD5
6bfef990369fee2cc5ec8605b5d0ce51

SHA1
aeddc9116de32f60156860eac0e2301d41275c53

SHA256
3c242dca190479fecf6f73e083d70097b6b835f26ba1613414ab7ea6480557c8

SHA512
8dd86385b5395dc6d6f0460cf9863fd3aab2942e1d31342b1d330e96886baf2a5a207dc5ab2d60747b10e68d124d8f3885ee74dd1186477997fffc53c80c349d

Download Submit
/data/data/stay.benefit.recall/app_DynamicOptDex/Gg.json

Filesize
632KB

MD5
78264d3e20ce5c48c395d05d5fe38ec5

SHA1
da11537c8f15de9150fa902767fac39f6952e58f

SHA256
b863a1f8fdbdee8eba238fd32820a942b6228cb4e71c33ce58208b6c3b0ae3f1

SHA512
928c931733d9b88391beb530f62779a4795bdcc45e6597d6833a480a971643b0fe22828d3b6c6fcdf30ce4eb03ea276d9f2d9faff103a9e7d0f819d124b8135d

Download Submit
/data/data/stay.benefit.recall/app_DynamicOptDex/oat/Gg.json.cur.prof

Filesize
873B

MD5
ff6efd6b851753f648da855b84dfc915

SHA1
a36633b7f5e69be37e94b090c33fe0557bc5fa12

SHA256
86e2ec285e45a69c435269a7aa558d690ec7952c07f8e5722fcc8c1cfeff303a

SHA512
45bfbdbdd5a8586ae87eddad23fb34be5e9857f8ecb76d36cfc80e02bdbd94dcd2daee9a92c43d89bb799aa5c3c742319b5efbba35962d13b07b8476dfc12c2d

Download Submit
/data/user/0/stay.benefit.recall/app_DynamicOptDex/Gg.json

Filesize
632KB

MD5
95c8e205c6820d2fc83b7fb114b70287

SHA1
9f46fe49d0375a1134cd955fe33a7f347b4142a7

SHA256
844c73322a597f3cd2a567b17d9bec3c8fce3d85f205e0b4d4f10672907571d5

SHA512
e6661ee8242713299aed7ecd21b2f4579337c55fc5cd7a67f8add4bc346822a1df130b18f1f55b8092e592708e6b14ca6b3eee6d6a07e3be7ddaddc8ab9974c3

Download Submit