cerberus | 4142993da33aab4ab5d4fe6893fdabd8dad03a336d433f1fdf30b9da57bbace9

Analysis

max time kernel
3772199s
max time network
150s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
26-12-2023 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80141238b73484038be9cf83e1919259.apk
Size

3.9MB
MD5

80141238b73484038be9cf83e1919259
SHA1

608526a615977d8371b51d6702e882e752d898e7
SHA256

4142993da33aab4ab5d4fe6893fdabd8dad03a336d433f1fdf30b9da57bbace9
SHA512

dbc962d1a53530d6c1a279fed541c85b783b6eac663e587e2d4373d493ce625281e91357321fc7bebe5b9e5d5feda89a30d8591d300390651e3e7161da728386
SSDEEP

98304:cbH2tYwDP9RiuwQvKxlPIBggggggg5ej7BTWTvwGl:m2tYY1RH7IlPIBggggggg5ehWT4Gl

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://199.188.203.218

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	eye.expect.able
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	eye.expect.able

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5002	eye.expect.able

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json	5002	eye.expect.able
/data/user/0/eye.expect.able/app_DynamicOptDex/TPn.json	5002	eye.expect.able

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	eye.expect.able

eye.expect.able
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5002

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/eye.expect.able/app_DynamicOptDex/TPn.json

Filesize
710KB

MD5
ba49f12485c2ed71ac660b065d7425fa

SHA1
a8f3fda2ab2aaaf4f4e1fb0971146f033b0099dc

SHA256
3e249faf501681534f25bb6d442ba724ec8188c5ae938722a8cc50f5ab147142

SHA512
68605545e93e67ef0083c16d6d133ef04a76e783063f1e2ef34d1456c14d3cdda0c2a074d1092b38b96816f8c0f727905e6d3449650bff65b05b9b0fdcf51088

Download Submit
/data/data/eye.expect.able/app_DynamicOptDex/TPn.json

Filesize
710KB

MD5
18603c405d98c799fa12e753b1039ca1

SHA1
ca542e2a06209eecd52aa24c679102068dc82dfb

SHA256
886d2de3b5f63125eda6a03603699de7d900104d61fcb729f38408380e45caed

SHA512
f768d895a05c5289c15881c73f89906de61f9f12a84e61c8b1105b29fb62bdca60e4b89b848fc713a5f0da7ecd784a8861b30ac46208a549949a0bcd41847c06

Download Submit