cerberus | 9058e9fc037a8732b07a4466abbb5a1c8ba299d4c5a87a4fbc4aa42ffe7021a6

Analysis

max time kernel
4041696s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31-12-2023 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ec3ab9056ec4cc2b8f901b4755088c1.apk
Size

3.1MB
MD5

2ec3ab9056ec4cc2b8f901b4755088c1
SHA1

ea2d68038dd493654b46d6c4c861819d6967f3b4
SHA256

9058e9fc037a8732b07a4466abbb5a1c8ba299d4c5a87a4fbc4aa42ffe7021a6
SHA512

bc00f277420e3eb0dba018576182d9f084c5bdacb01fbc16dffb7ca6928071bdd1d3d7bed903f8ddb54b21b3d16498ea883910b107f5f2fb019ff9b1b292c350
SSDEEP

49152:vX5Y84MsT90MHrjDeqN6WuJlK1WKI2+0N0RykMrT5iEWwVntkUcKxtAT2b5NwUs:N4MsR0GeqN6W84/N6yBrT52a2UcdiEF

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://asmakolpasinabakmadaxyz.shop

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	core.glory.theory
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	core.glory.theory

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4917	core.glory.theory

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/core.glory.theory/app_DynamicOptDex/RYRiAEg.json	4917	core.glory.theory
/data/user/0/core.glory.theory/app_DynamicOptDex/RYRiAEg.json	4917	core.glory.theory

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	core.glory.theory

core.glory.theory
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4917

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/core.glory.theory/app_DynamicOptDex/oat/RYRiAEg.json.cur.prof

Filesize
285B

MD5
487d8873cd4873fd9d35398ef933b17e

SHA1
151c9427368df2f81f055c742da72991af1f6ee6

SHA256
3552d2547cbf184842ab9feea1737aec271c3388134c1305d3ea8b7f32c14fd1

SHA512
bd69c15e37f69f186886199b5309c61ae10d158ed554e2924921a27f949d01043f95dbd16ffcb51a96c896f8c467840a4f9b34fafe1256471f9e0c99ed3def78

Download Submit
/data/user/0/core.glory.theory/app_DynamicOptDex/RYRiAEg.json

Filesize
674KB

MD5
dc69dd3bd84718cfef806e2f5190a20a

SHA1
d27f4b4a5e813ef4a6af99c16afcbcc94cc216d6

SHA256
057b62c4c4c1ddb8adf4283ee25095800099b3605d315b34e8019ad410ce34e1

SHA512
ad3dcca4cd227b3128a172a384f5b4a72ff6a3b26fed8facab8e9ae422e0ee18af36ede572ddb82fe8a8c19d9c54280dad0926e6a61222f4e94d4ad36a894d3d

Download Submit