cerberus | acdba5189ad88501274c446dbf3b040917cc4c1f1b67fb9e4d2f69c6805920c2

Analysis

max time kernel
86s
max time network
158s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
29-01-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

805c1d41637d0d7b18af82e421683f3f.apk
Size

3.3MB
MD5

805c1d41637d0d7b18af82e421683f3f
SHA1

cc683c563374efca3afce26946365c0a166959b4
SHA256

acdba5189ad88501274c446dbf3b040917cc4c1f1b67fb9e4d2f69c6805920c2
SHA512

7b6e41bab47b9b87a2de5dfb97980c12e43d06ff4c8aa5387fe245dd4d3f86e3d07c38dc96086a5dcc20a6551769891e87c65595cc7c5105dff55e380aa59b8a
SSDEEP

49152:Q72KTiQsCyRCOTvHKPKFXWVmB/9MAHDnqe3GeH+0zMooARZMLpa/5ozzUkR6JReH:rQsvRzCgGVm8AHGeBHdHGa/5ozzUwQ8H

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://samadeveloper.com/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	arctic.fuel.deny
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	arctic.fuel.deny

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4190	arctic.fuel.deny

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json	4190	arctic.fuel.deny
/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json	4244	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/arctic.fuel.deny/app_DynamicOptDex/oat/x86/rKS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json	4190	arctic.fuel.deny

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	arctic.fuel.deny

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	arctic.fuel.deny

arctic.fuel.deny
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4190
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/arctic.fuel.deny/app_DynamicOptDex/oat/x86/rKS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/arctic.fuel.deny/app_DynamicOptDex/oat/rKS.json.cur.prof

Filesize
895B

MD5
64e520fa3a78dc75cf51ac2025471ae1

SHA1
91dd853e061ce4e0788be362ce82acc268bc54ab

SHA256
896d7adfdb99840deaeed13446b54aa494931267abf6469e792f5c28844f3f13

SHA512
b916718df780c4a937938746b7ccab53cd6f646b5d35f3d630a46ff3dd88f5b74e4aed2b94fdbbd102129060d1d53fcb2c99e4a63a8b75e2b3cb742e143f09b9

Download Submit
/data/data/arctic.fuel.deny/app_DynamicOptDex/rKS.json

Filesize
741KB

MD5
93e0d7e1370645ec5a20baaeab0da033

SHA1
1905ddf7bf2e58ad64a6cc3406c71f0b67431660

SHA256
81888038daf76b5474c398f18633d64402126c67f449a17b2cb22bf67875eab0

SHA512
23ca94d7d6aa226164fa2db6d4db90bcd22ac9248577282a3324e3f1a1a62d4e13820e4dd43a80880043d76d35a0cbc4d601d1509edb627b2c8bb0cd86fb0f0e

Download Submit
/data/data/arctic.fuel.deny/app_DynamicOptDex/rKS.json

Filesize
741KB

MD5
bf0d3e40f5d5d7e8d369d8740898a926

SHA1
e0b467eeac4c14db7dd3c678529f51794b9c1999

SHA256
20fffa5f155c81ef36e61eb86ef9e31c61c347f71e650a561081016cf61f7769

SHA512
6e763ce52e8b54cc937935ded18c2b8e1e999209110fb34ba9a018d6e3c572726da31368382e486c76fb0533fee9a7a2d9193217d82be01f964ea977352debfe

Download Submit
/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json

Filesize
741KB

MD5
be45f6fde5c55f2445b283241393712c

SHA1
56f2ce32c10591b535c1b47a075e6c85e54d2ff7

SHA256
5fbaa9ad3a761a5c31cb9a3cc102c20a9b75225f543d2a4d3218db1f3b7db5f2

SHA512
ccde2c8ebdeee04f95f4163c8921f1eb3691cc924130ee84a0cb9ea860bdfc1822593404d9a7cbe415fd967c0a4882f07d7a7b4ac905a4241698f0f1009e98c4

Download Submit