cerberus | 5375ed5bf5cc2df45e19fe0c3ef7b98473d1907f20b2bb1243eaf6d3eb2a1d66

Resubmissions

04-02-2024 00:21

240204-anmgrsfeaj 10

03-02-2024 03:46

240203-eby29aagbk 10

Analysis

max time kernel
120s
max time network
131s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
04-02-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b504dfabe407c31c122e2df5f589f42.apk
Size

3.2MB
MD5

8b504dfabe407c31c122e2df5f589f42
SHA1

d58e93417044d57a7851b733fb4fce36c12ec3d9
SHA256

5375ed5bf5cc2df45e19fe0c3ef7b98473d1907f20b2bb1243eaf6d3eb2a1d66
SHA512

8ed1ed4e22cd7d8364618a657f2739c2936716e6c10dd3a6181b19f1f506af2d379ea079183760ccdb4211452eba81716a079906d31517252624e22a292d8c63
SSDEEP

98304:X+MlRhSI6vc9wJG7lcGDaWou1xLk6B96M3DsEd:X+gRhMz5tWou1xg6m0d

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://toanatroyxyz.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	solar.survey.roast
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	solar.survey.roast

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4190	solar.survey.roast

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json	4190	solar.survey.roast
/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json	4243	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/solar.survey.roast/app_DynamicOptDex/oat/x86/xSBaeiW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json	4190	solar.survey.roast

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	solar.survey.roast

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	solar.survey.roast

solar.survey.roast
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4190
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/solar.survey.roast/app_DynamicOptDex/oat/x86/xSBaeiW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4243

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/solar.survey.roast/app_DynamicOptDex/oat/xSBaeiW.json.cur.prof

Filesize
929B

MD5
1dc9f0c47f11a63fe6db9c1294aa4a16

SHA1
259f4cf45ea16acdcb05157d194e73969582dbf6

SHA256
50661654095e58c93093ddf3489182ead6f0a28ecbd6b833cff9add7345f176d

SHA512
de6b74a896bdc04cb2766a5760d1f67e89f0784c53688c493668ee60d40b74f391b0365267229db51c20bc5272850be824f003ce71e0a55d3500ecec80219f05

Download Submit
/data/data/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json

Filesize
716KB

MD5
c18bb2524c0f9408f10331b60a37ef71

SHA1
28f583e1598b7df483eb23848acaf96d1a422733

SHA256
1f555f527d7dfd9b0c6baf470b01f39de443a11932f990d83bf093749b0a59d6

SHA512
6ac80a6cf16a7f3eecf91eb66d3d1d033028e7b66a15bf0f7cd41e7792ff5d980257821d1e3e1b53721a77871a40144f78659e93c5e02762882bd7135293efa3

Download Submit
/data/data/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json

Filesize
716KB

MD5
5dfd4fb35d477844e9f65194ae2cbdf6

SHA1
1c863cb5e4ddd845d9a83031dd07682ccab241bd

SHA256
5397d244a52168b7f02e27c2a8c40a65bf9644e2ea4e924b80cb630af518bdd3

SHA512
ccc24c7b0a92d8ce55db651455dcaa3986c4fcf0b4679ce59411352f0010857c052c73bd21940c75871a89004a80550dd9e456594c808cb7835f999751888bcd

Download Submit
/data/user/0/solar.survey.roast/app_DynamicOptDex/xSBaeiW.json

Filesize
716KB

MD5
3ed52e59a931eb1427c362c0afd5a5b9

SHA1
fc6c9e4fc016e333e5451709b269263a8aac7300

SHA256
45bd43ae744a16ec0dc0d825aca4c07160c6c689994473595466bfd762b4ff08

SHA512
1f7127537d599fe8ffa7ec816973d047d815bea35e313cd4f5ae451251f5ada91a4c2cf75eca4423d8af3a972bdcfc1488387a0ec0592e1d5f77f476cc11fac3

Download Submit