cerberus | 056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b

Analysis

max time kernel
3089730s
max time network
156s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
29-12-2023 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03df6d51535847b17f543b7e92d4522d.apk
Size

3.0MB
MD5

03df6d51535847b17f543b7e92d4522d
SHA1

04b256b3fe13865bc67c10ac2315daa347211573
SHA256

056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b
SHA512

2cdf413b50befc35fde51bcf1addb0a0276d637edf797a2da7305efd3f9e425dea79d40fc916b8559eb701b480cbe5c5753c4789229485ae7de529c300b4015b
SSDEEP

49152:CrgwsjNyjDq+k66/NMCk6V5Dx5NHbBoPO7ftgHdh1dEgwKPwfTbnScR3/CN+F:C4YjDO6+NE6V1Lh50hgzwwfXnSzNI

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://somsombaba.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	segment.coral.blanket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	segment.coral.blanket

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4990	segment.coral.blanket

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4990	segment.coral.blanket
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4990	segment.coral.blanket

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	segment.coral.blanket

segment.coral.blanket
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4990

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
c491975251d44cd5e3d6cfa6a33c1663

SHA1
9d798814784079777416242317997df0bea0e87b

SHA256
063a40c99b625c031a1d8ea606e3314b1d6b1947a619147a1c4f3b117aa7c151

SHA512
499fa353d17b1776acf0dd301ebaed29e1acfaa49cef1078b78b359d88c5e531ff5ccf92d176d903bcb73dae873a96fb97656f4e0a8d7cbdecd90e8e55aefb9f

Download Submit
/data/data/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
564410a68f6618918d6d0cef70d28372

SHA1
824e31fd757e9f45b6d67c9c2a4af9eceeb084d9

SHA256
3545266dfbad88144667f432ccf9073129a61110a787f3f03ef4732a906490f0

SHA512
f7ae7c093e740563a33e2e7eb2ed7f772f0433c2db9c58f02441fd522a055efd987eef8a7b44f425ea3b7d0014e62b4f930b9124edc70b5352da96a8a2ea7615

Download Submit
/data/data/segment.coral.blanket/app_DynamicOptDex/oat/QOy.json.cur.prof

Filesize
252B

MD5
ce0e45e8ae50ee94fb981b4da52192ad

SHA1
580aeeb65606cf580ae2e77a1e3f8c438123eb34

SHA256
afea473128f27532f1b7eef210454324acc8d65602ff7320a933b96d8fa13f3f

SHA512
02cbecf3810dffa8a25f2f4adc90a735cb38cea98f559cda2746ff409d8296acbab15a363d2126c831a985654b263879abc243679fe8cc92ab8b6d9bc5d8a08c

Download Submit