cerberus | b8a12bb24e1ce1724ddec605f6c1c70f4a61273f8fc9cc76572f22531e3b871c

General

Target

bda0dc80bd225022dee98d7db05ffad5.apk
Size

4.6MB
MD5

bda0dc80bd225022dee98d7db05ffad5
SHA1

11569c6f438e2e885165128d43c382698674d743
SHA256

b8a12bb24e1ce1724ddec605f6c1c70f4a61273f8fc9cc76572f22531e3b871c
SHA512

2116b71a0b02a95e990be1f031223d10e1110c193f20b50f7efcb7293e75e272acef6ff837b53ea72e37d5d016681adf25b8559becc958cf35b10a1532904514
SSDEEP

98304:OH2+Gi6XUxrPgz7WItf0U1yvL2wJldXF5F2QdWZwONdpwWN8ge:OH2bigUxrPQ7JJr1yvLDJl5F2Q0rdpt+

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://144.126.152.229

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	loop.leader.athlete
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	loop.leader.athlete

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4289	loop.leader.athlete

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json	4289	loop.leader.athlete
/data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json	4320	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/loop.leader.athlete/app_DynamicOptDex/oat/x86/nGU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json	4289	loop.leader.athlete

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	loop.leader.athlete

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	loop.leader.athlete

loop.leader.athlete
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4289
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/loop.leader.athlete/app_DynamicOptDex/oat/x86/nGU.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4320

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/loop.leader.athlete/app_DynamicOptDex/nGU.json

Filesize
650KB

MD5
fd59f9823c9bf2e97e46859c70f5be6d

SHA1
20a4048c17245facd320b0807cc0595256ebea6f

SHA256
29d9f1e935c9030a0b9338bf37d35e3ac64781a844607038bd6d62c3eb652694

SHA512
52ab06105a7632279ebc8fa4dbd77a6daab0b834d5bffa1e7251e1d689ff2669578994270f61ba666f7fe45ab43f026dba8c837670c8f735c7b5158925a088f4

Download Submit
/data/data/loop.leader.athlete/app_DynamicOptDex/nGU.json

Filesize
650KB

MD5
3880ae785a9f64e3786e136277e31678

SHA1
c3e4fdb5c8986ac64fa8f647e4b7a76b07b7e0d6

SHA256
3448f80eba25143e4bba073f2e0ba617445e30bf1db8da3a2f10bea6709e148b

SHA512
8e531285a0ab68ae6e420e56ef03d82458e5e42c9629dbe738e6435245383bad6353541911ca882c5f72ee465045f1d4057d5c611fffb0c17e1cb2a4703d53c5

Download Submit
/data/data/loop.leader.athlete/app_DynamicOptDex/oat/nGU.json.cur.prof

Filesize
914B

MD5
802cb7c1a06c41da043abfa5cf650052

SHA1
fdc3fddccfbce6865e01a35be515c156be57d6db

SHA256
830c0507f083653557e9faf3fb3dbdb7d42a7b28551b80d65781dea3eec376ab

SHA512
35c3fdd7f3d7b2d12d4f43514940975a88008604d7feccb427b9a554c00d90264d77b4f9233a0d1818c314cb24895789f0d53e2d7c4f18e15755064e1a016e91

Download Submit
/data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json

Filesize
650KB

MD5
7e4f823090e025139477a52205864294

SHA1
c77e4f4f80356b21f0c3479c9bee8bf561ad0bca

SHA256
d28931e8aa05c8a5ff15623015db4f2ca75954ccf987ff38bc300567a0dce852

SHA512
8b1cc835b95f8d71fd1e300135939c7a3faefb9526635990b4d7f5134731d600c185897cdfd556d961e3bcc241169615a7f6528542756d17eaa61744ca78a1d4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads