cerberus | a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81

Analysis

max time kernel
52s
max time network
103s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
15-02-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81.apk
Size

1.7MB
MD5

7dd252bc7eb5a0f4af362b30a225b5ed
SHA1

e84bf0c991a22e3dff64231dc1508eeb9d1cbbf9
SHA256

a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81
SHA512

1342e015fc81da1fe16dd0fd32bdba6919517053fdcc45e4857fb85f9d827b040d96a2c3d3c02581a10e2db3b9a0b6d51aa7f233a5ed61474f18f9493c517841
SSDEEP

49152:uUahGKVUaBL2zClijxscjgVunVrgyk/9ygYmhFuONYIc2biMQ7:uUaAKVUaBLfglgExgx9/1hFuONU2biM0

Score

10^/10

cerberus banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://162.55.21.189

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.share.seed
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.share.seed

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4983	com.share.seed

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json	4983	com.share.seed

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.share.seed

com.share.seed
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4983

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
63KB

MD5
e55668923d7c9aec5e9e52268f37b14d

SHA1
0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

SHA256
b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

SHA512
ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

Download Submit
/data/data/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
63KB

MD5
decebb743a92fe0a0acfdeca968c5d6c

SHA1
d32c12030a200b5caf85a07c09dc063ad5431d44

SHA256
a92ea079b1602ca7a43ca2048e16475c2832a1b9b98c9602d30779aff6fb3981

SHA512
434557959be34d19c1c0b28a74d55c75aa44e97bab79fb55c03f66d29ae1856e78395976c27af6f3c1f4bf972753ab950339877ab7bb9c59cbfef4d77f2ad261

Download Submit
/data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof

Filesize
822B

MD5
8c072d9dbeddb79178b28f3a238062e3

SHA1
0de03ccc93f7cbb02f420488ff95528d5ba8f917

SHA256
5f514ea91641bd459a3cb1e09cd54008aaf51b646addd83ba83d6c3416e8cbaf

SHA512
eb1dd29b543ecfc81fe80d8ad24ace3f65719e314f856563f08d4407135ccb51159c1d6b03ab37a28674b502da462b184f3dba835b044b3babac0f876dac9f9d

Download Submit
/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json

Filesize
124KB

MD5
bf3a8b20950af2241e402aa6c819bcbf

SHA1
fbe7196d34d9fff857087a88a95df291b02e52c1

SHA256
307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

SHA512
68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

Download Submit