cerberus | eca82507af36f745dfa5b2f70c1ba8c41a39a4fa7fa8bb83dd4dfb7ed989af08

Analysis

max time kernel
65s
max time network
137s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
15-03-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb3b8bb92c43db38136fc856928e982a.apk
Size

133KB
MD5

cb3b8bb92c43db38136fc856928e982a
SHA1

0561150a99f522c2254717197bb15d56ccd46496
SHA256

eca82507af36f745dfa5b2f70c1ba8c41a39a4fa7fa8bb83dd4dfb7ed989af08
SHA512

d6558eadabb0de71ecd2190deb54e89d8179e16548b0287a171cebaf20b17d3a9e0f18d1cc1baeb31adf729af9fa82ec72d726439bd5780d2a5654b7a0e16127
SSDEEP

3072:EIwAo4L9WYbyOHChIrxwKyL4bm2o0puLuIQ2XzXcvr:73TTiqrxwZL4bmB0povQ2jsvr

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

https://herzamankigibigeneburdayiz.xyz

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.rppoc.dzbjpehejy
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.rppoc.dzbjpehejy

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5030	com.rppoc.dzbjpehejy

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.rppoc.dzbjpehejy

com.rppoc.dzbjpehejy
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5030

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads