cerberus | 887af2b78b764cfeff3af2b38aa58bb233db9f4d664cfd5c5ebaeaac3a03032d

Analysis

max time kernel
76s
max time network
147s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
31-01-2024 11:00

Target

843d6211d9477ca445dec6daf01c9776.apk
Size

157KB
MD5

843d6211d9477ca445dec6daf01c9776
SHA1

0bbb2459bef1a332ab4dc5578096d7edad9506fd
SHA256

887af2b78b764cfeff3af2b38aa58bb233db9f4d664cfd5c5ebaeaac3a03032d
SHA512

9759969684a0be4a85f3bd5a81ee3d47ffab29761830a330a71e4b1ebf1ec32d3087dcf97bd6c8c9e1cc98f35691d91af511d9865802aaf4132aff0bafc3f6bc
SSDEEP

3072:mP6pDNCh7fHU68CYr9oDhI29xspndSG0/5s54vmhBZyRTZyRIwNY3wNY6z:I6pDYNfH0xr9sshh09wIOY3OY6z

Score

10^/10

Family

cerberus

https://imkanversenizde100.xyz

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wldhedwydalsprk.xfptzni
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.wldhedwydalsprk.xfptzni

Removes its main activity from the application launcher 1 IoCs

pid	Process
5000	com.wldhedwydalsprk.xfptzni

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.wldhedwydalsprk.xfptzni