cerberus | 056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b

Analysis

max time kernel
3332186s
max time network
140s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
01-01-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03df6d51535847b17f543b7e92d4522d.apk
Size

3.0MB
MD5

03df6d51535847b17f543b7e92d4522d
SHA1

04b256b3fe13865bc67c10ac2315daa347211573
SHA256

056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b
SHA512

2cdf413b50befc35fde51bcf1addb0a0276d637edf797a2da7305efd3f9e425dea79d40fc916b8559eb701b480cbe5c5753c4789229485ae7de529c300b4015b
SSDEEP

49152:CrgwsjNyjDq+k66/NMCk6V5Dx5NHbBoPO7ftgHdh1dEgwKPwfTbnScR3/CN+F:C4YjDO6+NE6V1Lh50hgzwwfXnSzNI

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://somsombaba.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	segment.coral.blanket
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	segment.coral.blanket

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4270	segment.coral.blanket

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4270	segment.coral.blanket
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4295	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/segment.coral.blanket/app_DynamicOptDex/oat/x86/QOy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json	4270	segment.coral.blanket

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	segment.coral.blanket

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	segment.coral.blanket

segment.coral.blanket
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4270
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/segment.coral.blanket/app_DynamicOptDex/oat/x86/QOy.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4295

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
c491975251d44cd5e3d6cfa6a33c1663

SHA1
9d798814784079777416242317997df0bea0e87b

SHA256
063a40c99b625c031a1d8ea606e3314b1d6b1947a619147a1c4f3b117aa7c151

SHA512
499fa353d17b1776acf0dd301ebaed29e1acfaa49cef1078b78b359d88c5e531ff5ccf92d176d903bcb73dae873a96fb97656f4e0a8d7cbdecd90e8e55aefb9f

Download Submit
/data/data/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
564410a68f6618918d6d0cef70d28372

SHA1
824e31fd757e9f45b6d67c9c2a4af9eceeb084d9

SHA256
3545266dfbad88144667f432ccf9073129a61110a787f3f03ef4732a906490f0

SHA512
f7ae7c093e740563a33e2e7eb2ed7f772f0433c2db9c58f02441fd522a055efd987eef8a7b44f425ea3b7d0014e62b4f930b9124edc70b5352da96a8a2ea7615

Download Submit
/data/data/segment.coral.blanket/app_DynamicOptDex/oat/QOy.json.cur.prof

Filesize
887B

MD5
020f8be304fca9e6b72285b3f6cb57a4

SHA1
bacd221eb835e9914f744878a7a069baea90c0db

SHA256
2f1e4e4d7966100e9954732795ba6fa4de48feccc6223cc9ecca62859fa54fff

SHA512
fd6997f8da4ac59b578a3b205654fe43e8bc242f87c350e4b48dcd39ee5825989399f25a3395759fb300bb0384225107f760f4e74c550b539d302c015e43b7ea

Download Submit
/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json

Filesize
803KB

MD5
abccf1ef0267cac8f584de17e02f9470

SHA1
ea273b6f7d008e551dc78ee7a410e3b5c43edcbb

SHA256
1e7747f957c0e096e672bb06ad068a18fcc6cd7098173c6d9c81c9ff83d445bb

SHA512
27569b4dd1cfeebd6d2cc45b101531e0e58aa184e609c0a57d359841f98d49bb0d9b046991b2b3b6c312caebeef26d6a2a33107a84c3f3f469a0ad21080c2d5c

Download Submit