cerberus | 82e9ac0fa8d6699ac3bf8fd75dfef57b81fc874d7b5992eda93fcb8298104fee

Analysis

max time kernel
149s
max time network
157s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
04/02/2024, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9032341b8b2621a059d3e3373e9d2b2d.apk
Size

3.1MB
MD5

9032341b8b2621a059d3e3373e9d2b2d
SHA1

306f35e92f6779e6d264adf9d8dd70d920a59684
SHA256

82e9ac0fa8d6699ac3bf8fd75dfef57b81fc874d7b5992eda93fcb8298104fee
SHA512

0979dc9de65e30bc71345ead03b46c7281f492239282187a642ff7f76a90ab98bfd817f47d4af8697e28ec3798b5aff269bcc00b36329ecc9c507d56e9035fc1
SSDEEP

49152:mTI2AZTCK9QlHQnOzYOu7Dew+uSm/+45wVy1jvcifUR4mbZNJezOgK56RSUmA1BG:7ZTCWQKOuKw3TLc54G7B56Eeh/Cb

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://haniburadakimlervar.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mistake.nut.panda
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	mistake.nut.panda

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4257	mistake.nut.panda

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/mistake.nut.panda/app_DynamicOptDex/jL.json	4257	mistake.nut.panda
/data/user/0/mistake.nut.panda/app_DynamicOptDex/jL.json	4284	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mistake.nut.panda/app_DynamicOptDex/jL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mistake.nut.panda/app_DynamicOptDex/oat/x86/jL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/mistake.nut.panda/app_DynamicOptDex/jL.json	4257	mistake.nut.panda

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	mistake.nut.panda

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	mistake.nut.panda

mistake.nut.panda
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4257
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mistake.nut.panda/app_DynamicOptDex/jL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mistake.nut.panda/app_DynamicOptDex/oat/x86/jL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/mistake.nut.panda/app_DynamicOptDex/jL.json

Filesize
717KB

MD5
23b7bfcce68fb448f00139e9420f7b68

SHA1
0fbbae6877debbb3360c1f188b5f09f4ee6aaed7

SHA256
ab6f6e7b0bf13b99d7fb7bf989beecb7a06c94cd043072b8419bbf591f73ca08

SHA512
8e3f8fa31e9d864195f2175ee7603685ceecfa967c70355e9b62a14526e29b6e0adf477b5515a01b455b9c7627bb95bc992adf79e04f20dce3123724b4321f11

Download Submit
/data/data/mistake.nut.panda/app_DynamicOptDex/jL.json

Filesize
717KB

MD5
7a68d176f6232fd97f8132acbff70b75

SHA1
b6ffd2ccd6eb5d0be66b0923b1ccb8cc6602f563

SHA256
149a13d288c303832d4c2a441a65450d33e419d0b61f31161fb920e8dce89adf

SHA512
fc490c33ed21f474dabae711725db15d30f73be192fb6391be7b217838b21e15c0c088c3288792d63de4dc03b1f5835a233419862ff80bf76a13204a0ec1a634

Download Submit
/data/data/mistake.nut.panda/app_DynamicOptDex/oat/jL.json.cur.prof

Filesize
900B

MD5
b95fd7d098b910447d1416e9b8682e35

SHA1
27599ebe886134bd84d57fc551be8c9a0a67df76

SHA256
6acad8e2cf6445e98e25e54fd190c8913e51cd4cd8c614e8b92e537063e1e369

SHA512
e642ab2ded5d65e35af56fcf0a4a9d9c3e45db089c22ff01ce53acabe49042715643eb3418ec9bf014416900a5682949d44d51813a9fd81cc41c8de293d2288b

Download Submit
/data/user/0/mistake.nut.panda/app_DynamicOptDex/jL.json

Filesize
717KB

MD5
a455d1640bb9887cc9c602907d207822

SHA1
6a9ec373b445cfcacc6c40f9f85cc71041e1a7e9

SHA256
1204e32112b1d436e188ed0b540a60bb59da8e912988d08952494ace3f3cd450

SHA512
ec7c94fabc24481a66f447b658c96cdbc95e6dc00dc75d89561d0cc46800f21e2bda8cb064fec49d7a05b487e0617cae110c838ef8eb13d48e5c512d3b695db5

Download Submit