cerberus | 5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3

Analysis

max time kernel
132s
max time network
158s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
03-02-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d69dfc7d3b5c0287d903ab8ae77bddc.apk
Size

3.0MB
MD5

8d69dfc7d3b5c0287d903ab8ae77bddc
SHA1

c9b79ab4ad84cd03b9f407bdf317c6016a086921
SHA256

5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3
SHA512

79549a7054c54eb18ebfb411bcf4456cd33e8683df2f2e336de73a75d137e9b3da8eebfc4b1ab39403c64af9c7bab520400ad98bec4619b92cfed2b821083737
SSDEEP

98304:q1QJDqWMfANx6wJ3bVUyV2IGDU/oTADeI:q1MDbMwcwJ3f2Ig+L

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://turkifsapaylasim.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	jungle.view.suspect
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	jungle.view.suspect

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4987	jungle.view.suspect

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4987	jungle.view.suspect
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4987	jungle.view.suspect

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	jungle.view.suspect

jungle.view.suspect
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4987

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
3dffcdcdfbadc5429458902b2a8226ef

SHA1
08e9deab5dcd8ae8450ec352b9234b98d2119754

SHA256
5894567c51eec3491a397160a6f6809ab7d3a3f0edb8f3a98a443ab9f385b09d

SHA512
4b25c873f00b1bbe5cf33c247b0edbc9194fdafcb6d10b46c94bdedf4620cb59188846edcb4ded8c991c67b28ae9533ae971ca46e933c5ee8ae0cd83e33b097b

Download Submit
/data/data/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
ff3348058f39c589505279577cbecf8a

SHA1
b4d25205cea757ed54da82ff04e492d1b1eabafa

SHA256
e27ebed39a1191b0eb6315fe06991838362353725156c04bee17276864c56066

SHA512
29c14f403920a19a966020d058da45139e033768650140bd1df2c3553c3424565677f677b9ec19caa01523e1b3281047f14e7e0bd2a0a8d7c5880fb5633e80d8

Download Submit
/data/data/jungle.view.suspect/app_DynamicOptDex/oat/Ot.json.cur.prof

Filesize
268B

MD5
5fbce4623f60517c6f462f6631ed969f

SHA1
d8619ef990c4f4dfc346244dd692cdf3ea6459be

SHA256
2df2024ef66c010071ff71e89cef53f5558f8afd1e3c1b7c5da0a0014cb5fe37

SHA512
8aa389ad4fac52f7fd2e1a7a48a2632c2e1f7237e7c216229a0e4d4ebf987c8a3317bdf9591c2dfe1f6d937cfc08dc5c09d944a3dd8b681aeefa5950643a3bef

Download Submit