cerberus | ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa

Analysis

max time kernel
65s
max time network
157s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24/01/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

724326854d7a9a690804dddd1b2a8238.apk
Size

3.2MB
MD5

724326854d7a9a690804dddd1b2a8238
SHA1

77648e958dae35902a2da8e78abf1f63df6fbaff
SHA256

ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa
SHA512

bcdede85ed64d46007907e03fefda9170bdbbdd05ebcc83a42fc7aed54aa3fcf529dcd348e3bf9ed044e805a1e5e6861d589b7a10c86440c66d0254230fc7f71
SSDEEP

49152:FjswnszFXACO2rlrANH99yeSmjpHe/4zXLc8CycUsrYPPbk5/Ehi7vXBYc:4ZACOIW9EeUIbc8WUa4kGyp

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://147.182.194.197

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	chronic.scale.junk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	chronic.scale.junk

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4260	chronic.scale.junk

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json	4260	chronic.scale.junk
/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json	4287	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/chronic.scale.junk/app_DynamicOptDex/oat/x86/bYgKFBW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json	4260	chronic.scale.junk

Tries to add a device administrator. 1 IoCs

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	chronic.scale.junk

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	chronic.scale.junk

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	chronic.scale.junk

chronic.scale.junk
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Tries to add a device administrator.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4260
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/chronic.scale.junk/app_DynamicOptDex/oat/x86/bYgKFBW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4287

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json

Filesize
713KB

MD5
4b5ff17fa44ee3b99df6bdf832e73e48

SHA1
67bc08ff270c6124106aa13e173294e30b6cb6f3

SHA256
0f8d87d9160915c80c66f4e09bd725a4109bde3b1a56d79aabb85093464c557e

SHA512
b9a57e21a5df181f79112ad23850885299aa669a8636643f0e9613e6a69699a60f9b4967f5cee864bc1d1e48b3e6cbb53b094bb5592ee8c6a873644d8226c53e

Download Submit
/data/data/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json

Filesize
713KB

MD5
ef910dd30bfa0e174b9196f1d67c66d7

SHA1
2120e71352e1499a25bf1ac6400ec062cb7c532e

SHA256
68959304663b582441f785297cf3a5e6f2fd261f19346ea8026bb849d9f495cc

SHA512
1151ed9cdebcb9a7f23604626cae1a44560344a7c97bd9c9986abacd6cbef8cf5a3c978fab116e650488bd202f786aa50c17dcbf211dd4da69b5d67aff177037

Download Submit
/data/data/chronic.scale.junk/app_DynamicOptDex/oat/bYgKFBW.json.cur.prof

Filesize
895B

MD5
079860a59f42ad12a8b80098940c7c7d

SHA1
3bc5aa6bf0219dc75bef891717adb8efd374776c

SHA256
6fb495da12c51fb2976b6f2e7c2c6022b57aedcc14ddab005fd48714565382e4

SHA512
d057eba8f973c93c3c038e77396918933929b4c78b32b18f7872398a943dae61d0938a5fe4f01e8e3a3aa526778121fa53b4b309413070ccfae6a6c7ae6b03fc

Download Submit
/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json

Filesize
713KB

MD5
f0e7d203c3016104696d49393e56539e

SHA1
8b0b167371d4fae6b3ea3dacbd6e71fd066b42ce

SHA256
095ea842cb1f98af5909cd8291ce02eabde38399abc8812ac68a0e10c259d9eb

SHA512
2b21f8d8ba0667dd7a18a0ffc6ff26069e0ef5e71bd4396b9685927a6f5d0f0c9fc79dff3a229abf2c964964fde0f2e360d62d8aa582db344610e76cf6344701

Download Submit