cerberus | 62a7a7f546d7003809b9d3b183d9bb15ec74358e726dda8e172c94e773e20045

Analysis

max time kernel
83s
max time network
149s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31-01-2024 02:19

Target

832f4d834e830fdb1109a0aebc55ace7.apk
Size

133KB
MD5

832f4d834e830fdb1109a0aebc55ace7
SHA1

ed03de568c600fac7078c4a95f323a5f5c211493
SHA256

62a7a7f546d7003809b9d3b183d9bb15ec74358e726dda8e172c94e773e20045
SHA512

43312a073a3aca1e1abab831133571010b9df271d41228c4fe905f39c48be8919e65f394de0fbdc784e4d0619b54cd063e2bc502e4513abbdc9dfe5bf6c6fac2
SSDEEP

3072:6wfy5teCzlsv26jf1D8yh0GuLuIQ2XzXcvZ:6Ayn0Rjf1fh0GovQ2jsvZ

Score

10^/10

Family

cerberus

https://nerdenbuldunsengenebeni.com

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.anekprdmjzx.lqxebidaov
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.anekprdmjzx.lqxebidaov

Removes its main activity from the application launcher 1 IoCs

pid	Process
4985	com.anekprdmjzx.lqxebidaov

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.anekprdmjzx.lqxebidaov