cerberus | 7bde38712efb19c0aa80a13e7b4a9266325848ce41a9dead6bb6303c0fda8281

Analysis

max time kernel
53s
max time network
137s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
21-03-2024 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dab1b4ad7ca4da0abe15530b0e23e879.apk
Size

101KB
MD5

dab1b4ad7ca4da0abe15530b0e23e879
SHA1

c2a688fc8db609bfa67d8b5162b434244275abdc
SHA256

7bde38712efb19c0aa80a13e7b4a9266325848ce41a9dead6bb6303c0fda8281
SHA512

8d99b9090c7aaad1363ddbc658685a1de4d72db1abf9fc20e021e4bab093f6f9b7427f57555ff8a92fb4a1bdffc6471c56ce225fae492e9cd898ef5984622b45
SSDEEP

1536:8+bgK8tagu4T0Bc/1fFLvJSXdB26buOZVGViM6ndvFvE0BQ4x8h8o1QZ8JZ8Hp:8+cKC6c/19lS5CotFvr8h8o1QZ8JZ8Hp

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://192.3.15.118

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cywiw.hbjzghsfnx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cywiw.hbjzghsfnx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cywiw.hbjzghsfnx

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5046	com.cywiw.hbjzghsfnx

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.cywiw.hbjzghsfnx

com.cywiw.hbjzghsfnx
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5046

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads