cerberus | 203ff08786e36953f9a8fcf27cc28edfc4cac0d6e02e5f43e6c236f37a428b33

Analysis

max time kernel
3286024s
max time network
158s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
30-12-2023 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d755806e0b3de29faf431c891921c2a.apk
Size

3.9MB
MD5

1d755806e0b3de29faf431c891921c2a
SHA1

73aeceebd43de7fb385deb42f1352bd7d35335ba
SHA256

203ff08786e36953f9a8fcf27cc28edfc4cac0d6e02e5f43e6c236f37a428b33
SHA512

de95e9c1c24ede26cb81a5f9adbb65717a0c1da5f63ddb39d6f9cf1fc97176af07966e745f4f66e599f4c781eb1eb74cb3f02b10a9385c510635448f5c984661
SSDEEP

98304:OUaonkMLwTeks5cSA9YUa90w7CKbbC8JefCMyhJ5u3CD8:oonkML4eks5cSGG2INbCwT+H

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://systemsettings.cf

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	stem.crisp.garage
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	stem.crisp.garage

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4989	stem.crisp.garage

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/stem.crisp.garage/app_DynamicOptDex/BH.json	4989	stem.crisp.garage
/data/user/0/stem.crisp.garage/app_DynamicOptDex/BH.json	4989	stem.crisp.garage

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	stem.crisp.garage

stem.crisp.garage
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4989

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/stem.crisp.garage/app_DynamicOptDex/oat/BH.json.cur.prof

Filesize
254B

MD5
bed777818bd5983d2b2d63db634a38a6

SHA1
d5702b6af6c489efa52798b73ced5821db8fe722

SHA256
e6e9edc44dabde1b65dcc8d6dc11efcba6bd0092f254af812ea120c23c25e5a3

SHA512
eaf100b4b1ea553f0653ee33b5ca39b69f80cf15270dd3196c0402d9aebebf4b4f0dd6da60c80e30df9e0c18eca51fb6455daa350ad8e5e39d113ade57d35e4f

Download Submit
/data/user/0/stem.crisp.garage/app_DynamicOptDex/BH.json

Filesize
710KB

MD5
ee0005a75b000bbb4f3fcdafe1118645

SHA1
c5d39b209162e7c1eef2744d3ddf35ef5024eba8

SHA256
75e2862a63eba2aef1da8c818544029a0b84142c90220f00a7145ef82c09ccf5

SHA512
ea1fa29368831d2c92d1862b22f4b5756a81699ba28de78ef11dbb4da630f6b8a5a23492f1cb9942e743841d01fe0a725fc3f606b9dcf352e6da9e4f3270a294

Download Submit