cerberus | da6ad6b01c00868cd5f7d60aecac9b9d3b651e83c8e71fbfe8e2922fedf84575

Analysis

max time kernel
72s
max time network
131s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
13-02-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99ff688d1a2b535bb025eaf91367d6d9.apk
Size

3.0MB
MD5

99ff688d1a2b535bb025eaf91367d6d9
SHA1

d3bd5fcca0285244d6c4d56f9e87c481fdc9a85c
SHA256

da6ad6b01c00868cd5f7d60aecac9b9d3b651e83c8e71fbfe8e2922fedf84575
SHA512

4b76a3250e2c12b6d7821f8799a9bbaba18ce81ffc4de643460e0d1d1c228022f5753c7aa04ef9d0d72e5b87fccc446c168b3f47b4543663405d51f39224eb4e
SSDEEP

49152:tzRvJXKb1k0kaBGISz9uw6QdGyuKYCHfJBA3JNa4n0XG0nqGKqa7Jhezy/tKo8:k+0LBGIQ9fbdbQAEZNH0XpnqG8k3

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://somsombaba.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	estate.cake.crush
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	estate.cake.crush

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4505	estate.cake.crush

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json	4505	estate.cake.crush
/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json	4532	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/estate.cake.crush/app_DynamicOptDex/oat/x86/pMO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json	4505	estate.cake.crush

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	estate.cake.crush

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	estate.cake.crush

estate.cake.crush
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4505
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/estate.cake.crush/app_DynamicOptDex/oat/x86/pMO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/estate.cake.crush/app_DynamicOptDex/oat/pMO.json.cur.prof

Filesize
915B

MD5
d41aba60b4b62206b315a8ad07e8f73c

SHA1
46b29858545dfdf6addb778f881add849da3f9c4

SHA256
c71d32297e848f52ceec5a838cb9ac94a3d18f416fc8155e2d870856b7f22e2d

SHA512
11678ba7f9bdd967557325e708140fdbb9a66abb6943dd300acb809cec08b5b5fc8dad06b5b23545f1ecef5b095aad23322c1bd9afb25d23c57d860b90205aa2

Download Submit
/data/data/estate.cake.crush/app_DynamicOptDex/pMO.json

Filesize
709KB

MD5
2e04f11062c2bbda6c3cdcf0a6fae086

SHA1
b4cb7d9433108de2675e01097402d853fc332d39

SHA256
281129f92d402aa2b5884e597eda60027d5695efd859b29cc3e59bd88c06f6b7

SHA512
3b616084fadcbe0f78272b934939dd30fa8481042de58307dc299af2250fd158a3610366863597674335b624d6c1e9d922729760f33f0e989ad7f75670d0936e

Download Submit
/data/data/estate.cake.crush/app_DynamicOptDex/pMO.json

Filesize
709KB

MD5
a81b540a1b6225eb86374cf85db257bf

SHA1
76f878e135cea17e3a7e3e7808e4be1b774a30ea

SHA256
cc76bfd537f15a42f05eadbffab3284bf030cc7e9b7eb339598d42c832f76ebb

SHA512
80a949eb2207193b9981270c18df16fff854e2d8a6e4351bbe91541d36077bb834a76a3234d8ae0dd2058ad8e034ee88e366820ac6d0ce9be9613cd4e4202e0d

Download Submit
/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json

Filesize
709KB

MD5
e511bcc895c4da68f2c7eabfb627398d

SHA1
2052f3807daddec66e283e7dc60b7b3e635959f5

SHA256
9501ff366b1bc860183bb2cb86f2cccab87b0419e5168d143d1395f0d4da1823

SHA512
a3eadb017b7d254ab6ff7bd5720bfa45e8e6246edcfe88eff3e865314689d7c427c8ccdb56d42ecdf3234948bd6e6537c4c94b0b8882ae174cfdb45273e5902e

Download Submit