cerberus | a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81

General

Target

a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81.apk
Size

1.7MB
MD5

7dd252bc7eb5a0f4af362b30a225b5ed
SHA1

e84bf0c991a22e3dff64231dc1508eeb9d1cbbf9
SHA256

a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81
SHA512

1342e015fc81da1fe16dd0fd32bdba6919517053fdcc45e4857fb85f9d827b040d96a2c3d3c02581a10e2db3b9a0b6d51aa7f233a5ed61474f18f9493c517841
SSDEEP

49152:uUahGKVUaBL2zClijxscjgVunVrgyk/9ygYmhFuONYIc2biMQ7:uUaAKVUaBLfglgExgx9/1hFuONU2biM0

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://162.55.21.189

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.share.seed
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.share.seed

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4273	com.share.seed

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json	4300	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json	4273	com.share.seed

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.share.seed

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.share.seed

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.share.seed

com.share.seed
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4273
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
63KB

MD5
e55668923d7c9aec5e9e52268f37b14d

SHA1
0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

SHA256
b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

SHA512
ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

Download Submit
/data/data/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
25KB

MD5
dd211363a0c029ef2a3ccd8fb863489d

SHA1
0688b2d421d60555530b76fcb6b02a0d15e74288

SHA256
9b6a159db1e1379b8494aaa989d3e48a707f3b43ab6df38547ae50468c171969

SHA512
1e8be67cc8916e410cbc8098adf0c93abb33346ff195eea80a591359fadc57de701dcae1a7c4609a80e5a97cbc220f8f52d3c227d34180ff6a56425496c2abb3

Download Submit
/data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof

Filesize
841B

MD5
07cff37d95c9a6a2792ba63a5c2798a1

SHA1
eef1271b007c10c0a3b1b9b7b07e5048c1995a72

SHA256
836c42f4e5eb7f8406aea2666fadd80f076dbcf8f07aafc573e0f1dfc88ff430

SHA512
78b7114f6fba5c258f3eddaaf0ac14ae61e2c2ba53c9c9df127794c82d5adeeb0fbfd83fec77dcc778c27b533e59f926e3f9c5e12b13a551af3f119efd2d2a57

Download Submit
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
124KB

MD5
02d0a7ebb9a9e83f1ff75fcd631bea91

SHA1
4227f46b3c07a93b585a19fa1b5294ea616abcd6

SHA256
086694c946a8b7407e34734d221148f1c52fe9d0e5a0d680c707a586427c4852

SHA512
3554ba5cdee20b4a252d43ec45540a177c7f5bfdf0febc0c2abe1d48450a0284fe2108a0392765f524840572824a15642fd6c5aeef3221ec16938835651047f5

Download Submit
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
124KB

MD5
bf3a8b20950af2241e402aa6c819bcbf

SHA1
fbe7196d34d9fff857087a88a95df291b02e52c1

SHA256
307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

SHA512
68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

Download Submit

Analysis

Sharing