cerberus | 4142993da33aab4ab5d4fe6893fdabd8dad03a336d433f1fdf30b9da57bbace9

Analysis

max time kernel
3772195s
max time network
142s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
26-12-2023 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80141238b73484038be9cf83e1919259.apk
Size

3.9MB
MD5

80141238b73484038be9cf83e1919259
SHA1

608526a615977d8371b51d6702e882e752d898e7
SHA256

4142993da33aab4ab5d4fe6893fdabd8dad03a336d433f1fdf30b9da57bbace9
SHA512

dbc962d1a53530d6c1a279fed541c85b783b6eac663e587e2d4373d493ce625281e91357321fc7bebe5b9e5d5feda89a30d8591d300390651e3e7161da728386
SSDEEP

98304:cbH2tYwDP9RiuwQvKxlPIBggggggg5ej7BTWTvwGl:m2tYY1RH7IlPIBggggggg5ehWT4Gl

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://199.188.203.218

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	eye.expect.able
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	eye.expect.able

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4204	eye.expect.able

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json	4204	eye.expect.able
/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json	4277	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eye.expect.able/app_DynamicOptDex/oat/x86/TPn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json	4204	eye.expect.able

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	eye.expect.able

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	eye.expect.able

eye.expect.able
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4204
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/eye.expect.able/app_DynamicOptDex/oat/x86/TPn.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4277

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/eye.expect.able/app_DynamicOptDex/TPn.json

Filesize
710KB

MD5
ba49f12485c2ed71ac660b065d7425fa

SHA1
a8f3fda2ab2aaaf4f4e1fb0971146f033b0099dc

SHA256
3e249faf501681534f25bb6d442ba724ec8188c5ae938722a8cc50f5ab147142

SHA512
68605545e93e67ef0083c16d6d133ef04a76e783063f1e2ef34d1456c14d3cdda0c2a074d1092b38b96816f8c0f727905e6d3449650bff65b05b9b0fdcf51088

Download Submit
/data/data/eye.expect.able/app_DynamicOptDex/TPn.json

Filesize
710KB

MD5
18603c405d98c799fa12e753b1039ca1

SHA1
ca542e2a06209eecd52aa24c679102068dc82dfb

SHA256
886d2de3b5f63125eda6a03603699de7d900104d61fcb729f38408380e45caed

SHA512
f768d895a05c5289c15881c73f89906de61f9f12a84e61c8b1105b29fb62bdca60e4b89b848fc713a5f0da7ecd784a8861b30ac46208a549949a0bcd41847c06

Download Submit
/data/data/eye.expect.able/app_DynamicOptDex/oat/TPn.json.cur.prof

Filesize
903B

MD5
2d5c3e16f5d80e4c232bc17e2d2530cc

SHA1
15062aaf0f679fd79618bd4ab0f0d91cc801f51f

SHA256
b9edb94e8ce5d55db3a38171011e46fd5f7bc92bb8f218eae5d85fa1567c42f2

SHA512
035cbf63ca63a9d18f11632103c8d6350d750c697f69ffd6744eaeb3c572bf995c4ae227ff76d2fd0a66487263308e726799e89a27dca90aa46d2a788007d996

Download Submit
/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json

Filesize
710KB

MD5
3281ed54e292a944abceca2fca5b9422

SHA1
4b93698e4d20a00973d82abe1eb6d6668d695c46

SHA256
cabea8f3611efb5a5828f95083f3103a9b8d06d46e1f88a7dab42da974381e71

SHA512
b237a4c86a8fea89803042ae96cec7d2203b9351c40e917e64bb7930a7ace6f7261e4f75a2b7bb29dd87c50dd699dfe3c76bea1b11e5ad0d20e7612ec6b7772d

Download Submit