cerberus | e5058aa3e87cc6bb71fdcb959554e14f5354da24b23350296e406d3f1559a1c3

Analysis

max time kernel
4110509s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31/12/2023, 14:04

Target
39184e0c52ee804e0c0fa988193e0c1f.apk
Size 119KB
Sample231231-rdcm9acfb2
SHA256 e5058aa3e87cc6bb71fdcb959554e14f5354da24b23350296e406d3f1559a1c3
MD5 39184e0c52ee804e0c0fa988193e0c1f
SHA1 c91dca0e425ab7a1e85d14ed54033a1a094308f5
SHA512 fd5503077351c6a51e606c92007994c88b8b9c3a45bb01db8ad5b381d2eef58364caefdde81e2332932bf1d467e3f327246a08d0029ba66408ab719793002836
SSDEEP 3072:aEo0zISHXD0zMegVtqYLlCVhfLb0Dcdg9xxAhsghsH010K0f:afeISHXDEJgXPLIhfLADcS9xxArq010h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zljzbylqhalslok.xapkyp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zljzbylqhalslok.xapkyp

Removes its main activity from the application launcher 1 IoCs

pid	Process
4916	com.zljzbylqhalslok.xapkyp

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.zljzbylqhalslok.xapkyp