cerberus | eeb5699423902d7422482cbbe30a025180155edb3aaeb625446e403c46f944f3

Analysis

max time kernel
3038475s
max time network
154s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
27/12/2023, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b82c32069c0a7bc7d8c01aca3d886558.apk
Size 3.9MB
Sample231227-2cfzdsfcen
SHA256 eeb5699423902d7422482cbbe30a025180155edb3aaeb625446e403c46f944f3
MD5 b82c32069c0a7bc7d8c01aca3d886558
SHA1 076bba36db9a370f1b578ab9e28e993eabc74a30
SHA512 1c68f0edd814b982f844fe6723dcad604b6219abdcba84d010b45fb1bf199d893d19c8e98dce3821f30bda44d37174af0b7c42d170618b3a44d6acab586a0b71
SSDEEP 98304:RLe4Mws9n4MkjaX5EUwBGKbxcFG4l+D1T2:RLe4Mb9n37S4FG4l+pS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://178.18.251.169

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	among.caution.source
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	among.caution.source

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4916	among.caution.source

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/among.caution.source/app_DynamicOptDex/mYko.json	4916	among.caution.source
/data/user/0/among.caution.source/app_DynamicOptDex/mYko.json	4916	among.caution.source

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	among.caution.source

among.caution.source
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

mYko.json

Path /data/data/among.caution.source/app_DynamicOptDex/mYko.json
Size 714KB
SHA256 f5f17b614fa3b009437893025f1400fb69611f24c291fd9977928fc307a04416
MD5 bec9b4f40d54b030b96ce154fa6d6136
SHA1 affe06c1e4815d5f60c775299ac2936658f78e3b
SHA512 dd0f5638fc147112ea11dc2588234797333287e0dc452ee08d685d7722bceabfbc4c672c1b7361a82fa59f0bb3efbcdfc9af319784ec30819ce1f0530345a5f0
SSDEEP 12288:/z4VcQsUUf85rlCNIsLiNl9xMjBQ1qe83WgbKDlMmu0aZFxcr:/NUUf852IUiNlmQ1qe3gbglMmu0WTcr
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYko.json

Path /data/data/among.caution.source/app_DynamicOptDex/mYko.json
Size 714KB
SHA256 736ac24cd76fa729cc2af5f0a80c2b51b4b5572fa206eab049b029154e960779
MD5 3ad737cb3d5112ea8b6370e18eb7107e
SHA1 d949dce9fb67db89b32cc17a647977c8b4616f24
SHA512 102925532853f7e892792f797675600d826e92140fb09455f199af2a6e8629b4bdcfc84cc36f7f462404662f401afdec8deada43e1326ca321986ffeb240cf3c
SSDEEP 12288:27DyBMVyiUJDGw4RpOvNa/QiYu7d+keqHhKtcRksTkc5Qb9pcwyt98P:6yK8ic4LOVaeufHhNRicm9iK
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYko.json.cur.prof

Path /data/data/among.caution.source/app_DynamicOptDex/oat/mYko.json.cur.prof
Size 282B
SHA256 51bc7d7142d791491857c409aaab643e34d1624a25180bf439275e3f384160ce
MD5 91140768815025f7b7530d5c01101d87
SHA1 b7a8de6d930bc11fb33bf2e4827b11b5d8924ff5
SHA512 db86ba8edec6fe14a0fc3cae1e4b0cc0a440f9fe6f4735e0ac40f019ea0f2371d8e182e2610174d2952fe7997a60ff8b1ac9d81b077ee9f7a1a72ed8775e4887
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads