cerberus | 13436d21d21a1e1229d45603a5ed503ec6b916a7325fb387c9aa654aa0a112fd

Analysis

max time kernel
62s
max time network
131s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
26-01-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13436d21d21a1e1229d45603a5ed503ec6b916a7325fb387c9aa654aa0a112fd.apk
Size

3.3MB
MD5

f1405383ce3d4b7e3688a92f4ff14262
SHA1

4584f60bc3391ef11c00f035dbe5b34d9817c5aa
SHA256

13436d21d21a1e1229d45603a5ed503ec6b916a7325fb387c9aa654aa0a112fd
SHA512

fa661c8d2fe3b2123afaf2e8d626055940d7529b672600c2bce15709bfe5db3997f78d8d185768a5a43bfd53f07597ec1a7a1680f98eade980441baa52299cf7
SSDEEP

49152:zZqa9XFAIdQjvlY+36tm5en6LeXryLOZB87V92gE7EpdlmcEuVaHKVWcnTq9:zVDh6jvLqUS6CWLV5EQDpERqV5q9

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://185.177.59.179/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	oxygen.punch.festival
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	oxygen.punch.festival

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4481	oxygen.punch.festival

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/oxygen.punch.festival/app_DynamicOptDex/lnAK.json	4481	oxygen.punch.festival
/data/user/0/oxygen.punch.festival/app_DynamicOptDex/lnAK.json	4508	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/oxygen.punch.festival/app_DynamicOptDex/lnAK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/oxygen.punch.festival/app_DynamicOptDex/oat/x86/lnAK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/oxygen.punch.festival/app_DynamicOptDex/lnAK.json	4481	oxygen.punch.festival

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	oxygen.punch.festival

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	oxygen.punch.festival

oxygen.punch.festival
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4481
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/oxygen.punch.festival/app_DynamicOptDex/lnAK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/oxygen.punch.festival/app_DynamicOptDex/oat/x86/lnAK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/oxygen.punch.festival/app_DynamicOptDex/lnAK.json

Filesize
713KB

MD5
eb3ca2bd108f9647d7b1328543ca8e12

SHA1
b7a4e9182bddb60ad01972bceeaa20e7bb5d498d

SHA256
5ede27ca919ee0c5af0197f770776e7bfb94936451463d65a6748755809bb9c5

SHA512
778b99ec1d7511baa643a391387a192b58f152659ab9c9de527abf25893f3bd9172bf5d7cba902a4d5b83daa2060cf6840a89ff8560446a35f6f6c6eb897a5b2

Download Submit
/data/data/oxygen.punch.festival/app_DynamicOptDex/lnAK.json

Filesize
713KB

MD5
f64316a187642d9dd9a46487e8619f52

SHA1
d8a4d89c99489836a110cf552a5c02cd74afeac6

SHA256
f61fb9b03f6191fc600d9c4b83ebd58ecadc47da1f833712f4ca1e74bbc71688

SHA512
9e04f91da35ae9fbaff22591718fdde95bef8f4e967b0a2aa5ed4dce47fbec20779352dd9b0602fe6bdec0387dae986895a1c0e51f2153d3693e735357fef40d

Download Submit
/data/data/oxygen.punch.festival/app_DynamicOptDex/oat/lnAK.json.cur.prof

Filesize
888B

MD5
df24957088e0e84df1509eb31f437418

SHA1
890f61533b43841b606f158941ba27e674c491a7

SHA256
f03dc32c308c7d33e539c9975ae4e02d222cade73d9e1f00dd21e36cac63d51d

SHA512
9b2424368de8a2ed97c396cea8ebed7ac0038764ad766757c409a3043c916ee9c8e4126141e506a363b45f6a9f84f699e8fbb25b43f30d2f3a5a30b6c8aee54a

Download Submit
/data/user/0/oxygen.punch.festival/app_DynamicOptDex/lnAK.json

Filesize
713KB

MD5
87fd52c680ce9217da5addb385832819

SHA1
74e896afb149f6d547c12e85d58e6277066760c9

SHA256
600793d1a39abab3bdb49c43082ac2d9b7a8adf2793ba0a70e0ed2cc75f2b1e6

SHA512
7cd5eec33623b1f5b52ca2fd9781aa7cc791aca351c85fd7d2a0c5dd75fdc73be9d20e67e1238ae4cf84b05797b5797ccced25f4e1a6a44acebf9e4bc7434e20

Download Submit