cerberus | 5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3

Analysis

max time kernel
50s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
05-02-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d69dfc7d3b5c0287d903ab8ae77bddc.apk
Size

3.0MB
MD5

8d69dfc7d3b5c0287d903ab8ae77bddc
SHA1

c9b79ab4ad84cd03b9f407bdf317c6016a086921
SHA256

5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3
SHA512

79549a7054c54eb18ebfb411bcf4456cd33e8683df2f2e336de73a75d137e9b3da8eebfc4b1ab39403c64af9c7bab520400ad98bec4619b92cfed2b821083737
SSDEEP

98304:q1QJDqWMfANx6wJ3bVUyV2IGDU/oTADeI:q1MDbMwcwJ3f2Ig+L

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://turkifsapaylasim.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	jungle.view.suspect
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	jungle.view.suspect

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4915	jungle.view.suspect

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4915	jungle.view.suspect
/data/user/0/jungle.view.suspect/app_DynamicOptDex/Ot.json	4915	jungle.view.suspect

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	jungle.view.suspect

jungle.view.suspect
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4915

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
3dffcdcdfbadc5429458902b2a8226ef

SHA1
08e9deab5dcd8ae8450ec352b9234b98d2119754

SHA256
5894567c51eec3491a397160a6f6809ab7d3a3f0edb8f3a98a443ab9f385b09d

SHA512
4b25c873f00b1bbe5cf33c247b0edbc9194fdafcb6d10b46c94bdedf4620cb59188846edcb4ded8c991c67b28ae9533ae971ca46e933c5ee8ae0cd83e33b097b

Download Submit
/data/data/jungle.view.suspect/app_DynamicOptDex/Ot.json

Filesize
632KB

MD5
ff3348058f39c589505279577cbecf8a

SHA1
b4d25205cea757ed54da82ff04e492d1b1eabafa

SHA256
e27ebed39a1191b0eb6315fe06991838362353725156c04bee17276864c56066

SHA512
29c14f403920a19a966020d058da45139e033768650140bd1df2c3553c3424565677f677b9ec19caa01523e1b3281047f14e7e0bd2a0a8d7c5880fb5633e80d8

Download Submit
/data/data/jungle.view.suspect/app_DynamicOptDex/oat/Ot.json.cur.prof

Filesize
278B

MD5
b32b51fa99fb2efc7a2704753fced0c2

SHA1
f708af5d255fb62bdb5a60a2e8efd6a2e5fec01f

SHA256
f6a086412976cd728f491c708e9940052923fc68e5a1ca21aa8e3b5108889b87

SHA512
daa47739266b21d3cf4742111e5e65c18ac10360eb146c8356627b7fa98dd202d5183eafb62694ce2f3f13801ecdd40bf8d9a52f87f872881abe6aa5ca209025

Download Submit