cerberus | ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa

Analysis

max time kernel
60s
max time network
149s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
24/01/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

724326854d7a9a690804dddd1b2a8238.apk
Size

3.2MB
MD5

724326854d7a9a690804dddd1b2a8238
SHA1

77648e958dae35902a2da8e78abf1f63df6fbaff
SHA256

ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa
SHA512

bcdede85ed64d46007907e03fefda9170bdbbdd05ebcc83a42fc7aed54aa3fcf529dcd348e3bf9ed044e805a1e5e6861d589b7a10c86440c66d0254230fc7f71
SSDEEP

49152:FjswnszFXACO2rlrANH99yeSmjpHe/4zXLc8CycUsrYPPbk5/Ehi7vXBYc:4ZACOIW9EeUIbc8WUa4kGyp

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://147.182.194.197

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	chronic.scale.junk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	chronic.scale.junk

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5103	chronic.scale.junk

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json	5103	chronic.scale.junk
/data/user/0/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json	5103	chronic.scale.junk

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	chronic.scale.junk

chronic.scale.junk
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5103

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json

Filesize
713KB

MD5
4b5ff17fa44ee3b99df6bdf832e73e48

SHA1
67bc08ff270c6124106aa13e173294e30b6cb6f3

SHA256
0f8d87d9160915c80c66f4e09bd725a4109bde3b1a56d79aabb85093464c557e

SHA512
b9a57e21a5df181f79112ad23850885299aa669a8636643f0e9613e6a69699a60f9b4967f5cee864bc1d1e48b3e6cbb53b094bb5592ee8c6a873644d8226c53e

Download Submit
/data/data/chronic.scale.junk/app_DynamicOptDex/bYgKFBW.json

Filesize
713KB

MD5
ef910dd30bfa0e174b9196f1d67c66d7

SHA1
2120e71352e1499a25bf1ac6400ec062cb7c532e

SHA256
68959304663b582441f785297cf3a5e6f2fd261f19346ea8026bb849d9f495cc

SHA512
1151ed9cdebcb9a7f23604626cae1a44560344a7c97bd9c9986abacd6cbef8cf5a3c978fab116e650488bd202f786aa50c17dcbf211dd4da69b5d67aff177037

Download Submit
/data/data/chronic.scale.junk/app_DynamicOptDex/oat/bYgKFBW.json.cur.prof

Filesize
305B

MD5
adb1617da9c74749b85e5bd6008d4832

SHA1
61af0f04e67994d37d2171eadba22ddf794f436c

SHA256
731c2cea80a8818798f3e63044aeea88f09b38fecbe32d07b5caeb59f6b1c6ce

SHA512
bbad634cc3400dc6e3ddb0ef97109bf5926cc0edd6c36f119e32405725ef415cf1c4044ea1a71c0c611d0184053aa7b7ef8898198d3c9643dda239efc99782a7

Download Submit