cerberus | acdba5189ad88501274c446dbf3b040917cc4c1f1b67fb9e4d2f69c6805920c2

Analysis

max time kernel
72s
max time network
148s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
29-01-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

805c1d41637d0d7b18af82e421683f3f.apk
Size

3.3MB
MD5

805c1d41637d0d7b18af82e421683f3f
SHA1

cc683c563374efca3afce26946365c0a166959b4
SHA256

acdba5189ad88501274c446dbf3b040917cc4c1f1b67fb9e4d2f69c6805920c2
SHA512

7b6e41bab47b9b87a2de5dfb97980c12e43d06ff4c8aa5387fe245dd4d3f86e3d07c38dc96086a5dcc20a6551769891e87c65595cc7c5105dff55e380aa59b8a
SSDEEP

49152:Q72KTiQsCyRCOTvHKPKFXWVmB/9MAHDnqe3GeH+0zMooARZMLpa/5ozzUkR6JReH:rQsvRzCgGVm8AHGeBHdHGa/5ozzUwQ8H

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://samadeveloper.com/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	arctic.fuel.deny
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	arctic.fuel.deny

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4987	arctic.fuel.deny

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json	4987	arctic.fuel.deny
/data/user/0/arctic.fuel.deny/app_DynamicOptDex/rKS.json	4987	arctic.fuel.deny

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	arctic.fuel.deny

arctic.fuel.deny
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4987

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/arctic.fuel.deny/app_DynamicOptDex/oat/rKS.json.cur.prof

Filesize
234B

MD5
639a5ffb6c14ff5b5068d48c724f32b0

SHA1
db3d7e2654ab13937ae60df2ec06ed674dab846d

SHA256
a52c44edb66555dee31f453a5e1b735f069464cf7026cc6a6ddd81797e6e7488

SHA512
5079fee0210d2b27ada4d9e65488fd1835dfdaf291d67891d22a3c93fb0b85db8e144de6d38e55e5c7643fb187ef5a1478b4caa9045faa827ef75dfe42a391f6

Download Submit
/data/data/arctic.fuel.deny/app_DynamicOptDex/rKS.json

Filesize
741KB

MD5
93e0d7e1370645ec5a20baaeab0da033

SHA1
1905ddf7bf2e58ad64a6cc3406c71f0b67431660

SHA256
81888038daf76b5474c398f18633d64402126c67f449a17b2cb22bf67875eab0

SHA512
23ca94d7d6aa226164fa2db6d4db90bcd22ac9248577282a3324e3f1a1a62d4e13820e4dd43a80880043d76d35a0cbc4d601d1509edb627b2c8bb0cd86fb0f0e

Download Submit
/data/data/arctic.fuel.deny/app_DynamicOptDex/rKS.json

Filesize
741KB

MD5
bf0d3e40f5d5d7e8d369d8740898a926

SHA1
e0b467eeac4c14db7dd3c678529f51794b9c1999

SHA256
20fffa5f155c81ef36e61eb86ef9e31c61c347f71e650a561081016cf61f7769

SHA512
6e763ce52e8b54cc937935ded18c2b8e1e999209110fb34ba9a018d6e3c572726da31368382e486c76fb0533fee9a7a2d9193217d82be01f964ea977352debfe

Download Submit