cerberus | 056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b

Analysis

max time kernel
3089714s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
29-12-2023 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03df6d51535847b17f543b7e92d4522d.apk
Size

3.0MB
MD5

03df6d51535847b17f543b7e92d4522d
SHA1

04b256b3fe13865bc67c10ac2315daa347211573
SHA256

056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b
SHA512

2cdf413b50befc35fde51bcf1addb0a0276d637edf797a2da7305efd3f9e425dea79d40fc916b8559eb701b480cbe5c5753c4789229485ae7de529c300b4015b
SSDEEP

49152:CrgwsjNyjDq+k66/NMCk6V5Dx5NHbBoPO7ftgHdh1dEgwKPwfTbnScR3/CN+F:C4YjDO6+NE6V1Lh50hgzwwfXnSzNI

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://somsombaba.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	segment.coral.blanket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	segment.coral.blanket

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4252	segment.coral.blanket

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4252	segment.coral.blanket
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4309	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/segment.coral.blanket/app_DynamicOptDex/oat/x86/QOy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4252	segment.coral.blanket

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	segment.coral.blanket

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	segment.coral.blanket

segment.coral.blanket
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4252
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/segment.coral.blanket/app_DynamicOptDex/oat/x86/QOy.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4309

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/segment.coral.blanket/app_DynamicOptDex/oat/QOy.json.cur.prof

Filesize
902B

MD5
2726a337c4407cc283aa59451908215e

SHA1
9317b3f89ea9b375884c8677809aec54b5c4613a

SHA256
abc555a6ea8952fc0cfd128b3e444532de4205aa81e2eae90ec40554d0528de9

SHA512
6004cc6193ffc22d046d584098bfafa9d25372dcc20d78d72992386a337c2c2fbec031caa3eb8534585f696f765b1dfd4848032b8a44f754a3a0719b2cdb3ef6

Download Submit
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
564410a68f6618918d6d0cef70d28372

SHA1
824e31fd757e9f45b6d67c9c2a4af9eceeb084d9

SHA256
3545266dfbad88144667f432ccf9073129a61110a787f3f03ef4732a906490f0

SHA512
f7ae7c093e740563a33e2e7eb2ed7f772f0433c2db9c58f02441fd522a055efd987eef8a7b44f425ea3b7d0014e62b4f930b9124edc70b5352da96a8a2ea7615

Download Submit
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
abccf1ef0267cac8f584de17e02f9470

SHA1
ea273b6f7d008e551dc78ee7a410e3b5c43edcbb

SHA256
1e7747f957c0e096e672bb06ad068a18fcc6cd7098173c6d9c81c9ff83d445bb

SHA512
27569b4dd1cfeebd6d2cc45b101531e0e58aa184e609c0a57d359841f98d49bb0d9b046991b2b3b6c312caebeef26d6a2a33107a84c3f3f469a0ad21080c2d5c

Download Submit