Overview

overview

10

Static

static

6

8b504dfabe...42.apk

android-9-x86

10

8b504dfabe...42.apk

android-10-x64

10

8b504dfabe...42.apk

android-11-x64

Resubmissions

04/02/2024, 00:21

240204-anmgrsfeaj10

03/02/2024, 03:46

240203-eby29aagbk10

Analysis

  • max time kernel
    75s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    03/02/2024, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8b504dfabe407c31c122e2df5f589f42.apk
  • Size 3.2MB
  • Sample240203-eby29aagbk
  • SHA256 5375ed5bf5cc2df45e19fe0c3ef7b98473d1907f20b2bb1243eaf6d3eb2a1d66
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

  • cerberus

C2

  • http://toanatroyxyz.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • solar.survey.roast
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4217
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/solar.survey.roast/app_DynamicOptDex/oat/x86/xSBaeiW.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4242

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        xSBaeiW.json.cur.prof
        • Path /data/data/solar.survey.roast/app_DynamicOptDex/oat/xSBaeiW.json.cur.prof
        • Size 907B
        • SHA256 224ca68d4f9faf687e659421347f3c50dcf0aa0c18b3aa0a56265bca420de99f
        • MD5 SHA1 SHA512
        Submit Download

        xSBaeiW.json
        • Path /data/data/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json
        • Size 716KB
        • SHA256 1f555f527d7dfd9b0c6baf470b01f39de443a11932f990d83bf093749b0a59d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xSBaeiW.json
        • Path /data/data/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json
        • Size 716KB
        • SHA256 5397d244a52168b7f02e27c2a8c40a65bf9644e2ea4e924b80cb630af518bdd3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xSBaeiW.json
        • Path /data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json
        • Size 716KB
        • SHA256 45bd43ae744a16ec0dc0d825aca4c07160c6c689994473595466bfd762b4ff08
        • MD5 SHA1 SHA512 SSDEEP
        Download