cerberus | 62a7a7f546d7003809b9d3b183d9bb15ec74358e726dda8e172c94e773e20045

Analysis

max time kernel
83s
max time network
149s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31/01/2024, 02:19

Target
832f4d834e830fdb1109a0aebc55ace7.apk
Size 133KB
Sample240131-cr55dsbdfj
SHA256 62a7a7f546d7003809b9d3b183d9bb15ec74358e726dda8e172c94e773e20045
MD5 832f4d834e830fdb1109a0aebc55ace7
SHA1 ed03de568c600fac7078c4a95f323a5f5c211493
SHA512 43312a073a3aca1e1abab831133571010b9df271d41228c4fe905f39c48be8919e65f394de0fbdc784e4d0619b54cd063e2bc502e4513abbdc9dfe5bf6c6fac2
SSDEEP 3072:6wfy5teCzlsv26jf1D8yh0GuLuIQ2XzXcvZ:6Ayn0Rjf1fh0GovQ2jsvZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.anekprdmjzx.lqxebidaov
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.anekprdmjzx.lqxebidaov

Removes its main activity from the application launcher 1 IoCs

pid	Process
4985	com.anekprdmjzx.lqxebidaov

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.anekprdmjzx.lqxebidaov