cerberus | b40b9bf089b84e75979dc53905461793890f79bee528f123b594c22085e213b6

Analysis

max time kernel
46s
max time network
135s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
27-02-2024 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a910d26af2139ed9070774f36fa9bb06.apk
Size

136KB
MD5

a910d26af2139ed9070774f36fa9bb06
SHA1

817d6a8a2e8f846c980963a5fb37c6e06c7b30e3
SHA256

b40b9bf089b84e75979dc53905461793890f79bee528f123b594c22085e213b6
SHA512

99bcf7f6770e8ccecefccb2a1bec76f4adc2c61478cdeb51d534f57e10576c769cda4c291f5b2d2d5744428df40d7a0dc29088801ecd4bfb190f56e5b0b148d3
SSDEEP

3072:CiM5eROwXw442uc1oIfFSUSX4rqEq/JOmJOV8d8SwA4z4wA4z8UlvDm8eUlvDm8y:CX5eROsXw8fznrqEqQXCarA4z1A4zPvU

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://20.49.203.83/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.iuyfwbuglk.fcnamspjccytsdh
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.iuyfwbuglk.fcnamspjccytsdh
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.iuyfwbuglk.fcnamspjccytsdh

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5051	com.iuyfwbuglk.fcnamspjccytsdh

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.iuyfwbuglk.fcnamspjccytsdh

com.iuyfwbuglk.fcnamspjccytsdh
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5051

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads