cerberus | 5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3

Analysis

max time kernel
74s
max time network
138s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
03/02/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d69dfc7d3b5c0287d903ab8ae77bddc.apk
Size

3.0MB
MD5

8d69dfc7d3b5c0287d903ab8ae77bddc
SHA1

c9b79ab4ad84cd03b9f407bdf317c6016a086921
SHA256

5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3
SHA512

79549a7054c54eb18ebfb411bcf4456cd33e8683df2f2e336de73a75d137e9b3da8eebfc4b1ab39403c64af9c7bab520400ad98bec4619b92cfed2b821083737
SSDEEP

98304:q1QJDqWMfANx6wJ3bVUyV2IGDU/oTADeI:q1MDbMwcwJ3f2Ig+L

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://turkifsapaylasim.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	jungle.view.suspect
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	jungle.view.suspect

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4250	jungle.view.suspect

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4250	jungle.view.suspect
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/jungle.view.suspect/app_DynamicOptDex/oat/x86/Ot.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4250	jungle.view.suspect

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	jungle.view.suspect

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	jungle.view.suspect

jungle.view.suspect
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4250
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/jungle.view.suspect/app_DynamicOptDex/oat/x86/Ot.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
3dffcdcdfbadc5429458902b2a8226ef

SHA1
08e9deab5dcd8ae8450ec352b9234b98d2119754

SHA256
5894567c51eec3491a397160a6f6809ab7d3a3f0edb8f3a98a443ab9f385b09d

SHA512
4b25c873f00b1bbe5cf33c247b0edbc9194fdafcb6d10b46c94bdedf4620cb59188846edcb4ded8c991c67b28ae9533ae971ca46e933c5ee8ae0cd83e33b097b

Download Submit
/data/data/jungle.view.suspect/app_DynamicOptDex/oat/Ot.json.cur.prof

Filesize
890B

MD5
f23ccf951580af90e1a703104092f274

SHA1
53be33a99f8c5a4a98e19a7c9d00007cff7e67a0

SHA256
63dd0ceeea3375cbc6f506a251dfefa578913c3e7aa4a48a40e4c1f9a77dc1c9

SHA512
309922546cce8f4cb10b1df57e0b0eafe9913cee3dc6ba52f11bada0fa17ed62959efcdc70de5d39122c9fcd74e94124adeaafb75b28763112d45b323d959c5b

Download Submit
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
ff3348058f39c589505279577cbecf8a

SHA1
b4d25205cea757ed54da82ff04e492d1b1eabafa

SHA256
e27ebed39a1191b0eb6315fe06991838362353725156c04bee17276864c56066

SHA512
29c14f403920a19a966020d058da45139e033768650140bd1df2c3553c3424565677f677b9ec19caa01523e1b3281047f14e7e0bd2a0a8d7c5880fb5633e80d8

Download Submit
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
cf143016dd8966c46401be14d151c2c8

SHA1
e25c9bb49ad697101dc58a1572fbebcf17b24814

SHA256
1483a7612087dbaa927f90add35437a674481d378bf66461e069a4adf34ae9d0

SHA512
2cf45f623bd1fea78a9d7eaa580a826b9f3aa254da683ff19aca9fa9a1721ae2b5334863d39fa58e1bd1806742d31c40ad3491003505840e9c0c9ca827bfd235

Download Submit