cerberus | 1d75f7f5bee9118daad0d3ab6c47d95c3f7905a835e34b17655970926eb08f32

Analysis

max time kernel
83s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
27/01/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d75f7f5bee9118daad0d3ab6c47d95c3f7905a835e34b17655970926eb08f32.apk
Size

1.6MB
MD5

f48a97f159b38c4aaa14588c7d8cd833
SHA1

aa2b105ecfa79d5f6cc4aeceb5f61ca9f954f0c6
SHA256

1d75f7f5bee9118daad0d3ab6c47d95c3f7905a835e34b17655970926eb08f32
SHA512

9abc2880eb22b2edb0fd7e97fd576b875c032da4bc70c48002665dd57f5feca69d7a08fe45ba14d7cc16ba6e2b63bf71ab532bc43ab4641d961cb97eff09ddf6
SSDEEP

24576:CXmFv32p/5cqXLX1qQqdKg7/Ng4SCo5pIkMg92VV1DX91/6BtcM7Ds5oMNr4EQb4:CY/g/5c2LF2dd/Ngp3sDod7Abfye

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://51.81.222.225

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lounge.rich
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lounge.rich

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4243	com.lounge.rich

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.lounge.rich/app_DynamicOptDex/ddHty.json	4267	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lounge.rich/app_DynamicOptDex/ddHty.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lounge.rich/app_DynamicOptDex/oat/x86/ddHty.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.lounge.rich/app_DynamicOptDex/ddHty.json	4243	com.lounge.rich

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lounge.rich

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.lounge.rich

com.lounge.rich
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4243
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lounge.rich/app_DynamicOptDex/ddHty.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lounge.rich/app_DynamicOptDex/oat/x86/ddHty.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4267

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lounge.rich/app_DynamicOptDex/ddHty.json

Filesize
64KB

MD5
18293d58e9955325f6345f92b0794a2d

SHA1
6f14845623657253ba49d0eb6f3593ae314476e6

SHA256
60f2f662945a9b55bbd7f8c04f3bef05214004c856dd17ef2fa205a80d940be2

SHA512
0ef18267e797dfa421014784821b5f657d042d8ea1dc218ae57a53f79a8898406be72265ac1e0d732cf1e6df5c260d33daeb083bad43480192f64f5810d42dbc

Download Submit
/data/data/com.lounge.rich/app_DynamicOptDex/ddHty.json

Filesize
64KB

MD5
a8b2c918125b38343f025cc8058f20de

SHA1
2c66c2bf950a3320b91f7f4b2ea9bf05b93a0aca

SHA256
9581e3fd7943e7c7315c387d968234730b2f6e9e606f88a0beb0bb6e4d0a1e21

SHA512
a8f4cb91073f389bef45db7d71c153f37cbad081d3009434e2edd9c580dd3e7e6bc9e9b96eeb0f7cd00df170f24d4bab2b9f480f23f87da77beb1ec16e6b9558

Download Submit
/data/data/com.lounge.rich/app_DynamicOptDex/oat/ddHty.json.cur.prof

Filesize
818B

MD5
a8ccd2ebc9d34a166db4d68b8283819c

SHA1
e8053801560a6716bf9532da3366a73bc01980d5

SHA256
be82204097ee9a12bfdcf009282a879270933a9ea894e1520ee4b620a401beec

SHA512
e13aa8f85bbd07cf3534a1019cffeb8829ecec56b4348419f56056767e9223010c0192a7797d55c30b2bda7df7271a6eecb2d93718aa0f97f203805830d6d876

Download Submit
/data/user/0/com.lounge.rich/app_DynamicOptDex/ddHty.json

Filesize
124KB

MD5
2fc82aa1a730d6959d0df3ebd696c75b

SHA1
90d688438fb095b109c9a642f4349f53a31efb35

SHA256
8dd009fbeed2f8256ef83c5fcb2b52c11b376ce37f31c55658a4e20574cac93c

SHA512
928ef9fc30133e9ff796e11025be88d9c5c4041821248e575cb1ea43b8266306cf4e4ac973b17befe9e0214375b1f0723e2efd6effb82e334060e63ba39ea6bb

Download Submit
/data/user/0/com.lounge.rich/app_DynamicOptDex/ddHty.json

Filesize
124KB

MD5
939775621839081f8ceba766d16cdf8c

SHA1
ef20dad4f5caf539effdc622e66fab77169c860b

SHA256
b9ebfbe35139fc50e90d06c3add1f27d65c772f7d4f8d069584ef3fc2411cbd7

SHA512
d6a6fd8ffad0d1a82cb4de3df839ea81435f311fcb28dff4efa5aa1665316c94df5330e22060736612d9d8acc5238487b1e2cba0449c1f046fed38199fdad80e

Download Submit