cerberus | d8564f37d48a023ae2cbd2b7b27df61876a572b445db9c66ea904e95d2d64da1

General

Target

af620a62ab5911587b55a402bda10e7b.apk
Size

3.1MB
MD5

af620a62ab5911587b55a402bda10e7b
SHA1

48da6580f1aee833b8c76fbf19df1c9bda7fbbba
SHA256

d8564f37d48a023ae2cbd2b7b27df61876a572b445db9c66ea904e95d2d64da1
SHA512

c6d56c031358b7322f05e66e69f05aa91ea6e203a3fd5e61a66ab26ad843023263c0f82f335399b40d40b7066e78a192625766e059e21539843c121fa7014d39
SSDEEP

49152:x2CEh6eaR+wZhFcZnZtC97wHM9fD6PmF/n/L7qP3mHwtVHu5qJTs1EIMxPFAa3s:zeGEnZte7he+hD7qeHYGqJuMtKa3s

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://kusurabakmahayat.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	adult.cross.grass
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	adult.cross.grass

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4282	adult.cross.grass

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/adult.cross.grass/app_DynamicOptDex/Kanmko.json	4282	adult.cross.grass
/data/user/0/adult.cross.grass/app_DynamicOptDex/Kanmko.json	4308	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/adult.cross.grass/app_DynamicOptDex/Kanmko.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/adult.cross.grass/app_DynamicOptDex/oat/x86/Kanmko.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/adult.cross.grass/app_DynamicOptDex/Kanmko.json	4282	adult.cross.grass

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	adult.cross.grass

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	adult.cross.grass

adult.cross.grass
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4282
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/adult.cross.grass/app_DynamicOptDex/Kanmko.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/adult.cross.grass/app_DynamicOptDex/oat/x86/Kanmko.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4308

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/adult.cross.grass/app_DynamicOptDex/Kanmko.json

Filesize
651KB

MD5
7982a17a106c6699802e62208aadfb87

SHA1
2148d4aee3d239a776ca4b00b5a6b7d46feaa250

SHA256
f4943da2e1974827edce0fd0153afcd9108b1c77aae599f3c600af6e92234900

SHA512
9c31fd441593612eabc30ae1b86ca3a51778d938cde8190a41737d747e8c703b772a8b9774928119189f87bbc2f989600508f5fd10ebee9abd18583c68d1366b

Download Submit
/data/data/adult.cross.grass/app_DynamicOptDex/Kanmko.json

Filesize
651KB

MD5
fdd6a0df9c731eb8eee7148d50caef8d

SHA1
93ed5f9c544531a1fff4154d5e84cc4ace651011

SHA256
c63913c0319bfd0df22b440d28bf15de54bea7aaaf075c1a50a58e8443bcb16f

SHA512
f573e7c72da8b45b4e464a7b0ada118abbb6eda6544e3931e740ba716106cd839678cf0e843db6b6d92bb7669551746a13687627680063ef366ec64cb7bc8262

Download Submit
/data/data/adult.cross.grass/app_DynamicOptDex/oat/Kanmko.json.cur.prof

Filesize
910B

MD5
6f49f3691a0c974eeb2627e7578a6882

SHA1
0a578db352d4c5dd28954705c4e505bbeb525d4a

SHA256
9c47a46888947dd0a1d56be04ee1d3631829f57d58ce07df2a213c6608dd3abf

SHA512
e7c3ad187dd7c7d0db1581fed66a88f3142fbb53ebc97e124feb3a32b2eec008b42cc49448cab7f46e4f5f816debcb8b30131570d8fa3fe853d97be1edfab031

Download Submit
/data/user/0/adult.cross.grass/app_DynamicOptDex/Kanmko.json

Filesize
651KB

MD5
d3a7e1edd7114513e2db37449e0314e9

SHA1
afd24cb6644f8da1c7016bc153810e82a02d3127

SHA256
f8f6dfca6cbe50eba999d1e3d4562527475831762a693b9037a7054cdd09d68b

SHA512
32667275b36213856a00276ed02b32e82dc362297edb6c848ab2637de4cf34dd0ccbdd3ca1d95a3feecc8fbef0c61185c001ed7a7a1e156e2d446f211d9f4c51

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads