cerberus | 51bf7efcc3be6bdd787b7b675a59cc6aaca66ddd043451d17882164c71c91b7b

Analysis

max time kernel
56s
max time network
152s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
27-03-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e128aa32a49e33052293827a6cb1cfa5.apk
Size

133KB
MD5

e128aa32a49e33052293827a6cb1cfa5
SHA1

424c2a1301c7d96c02e94c07d1b76360948ff666
SHA256

51bf7efcc3be6bdd787b7b675a59cc6aaca66ddd043451d17882164c71c91b7b
SHA512

af07ab7b8021abcfe30789511213d88056ce70fdd51fefd8564f9bf3d04bb38615b7c2deaa75041d2773606edc5426a12c2dcd6949edf4083e41f4280977ea08
SSDEEP

3072:MYNP9LiLPSGibrJ25c07juLuIQ2XzXcva2U:MYNVASGi30/ovQ2jsvaz

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

https://bensiznekadarmutluolabilirsinki.club

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lwdsz.vlfhtcsvfxxrx
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lwdsz.vlfhtcsvfxxrx

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5109	com.lwdsz.vlfhtcsvfxxrx

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.lwdsz.vlfhtcsvfxxrx

com.lwdsz.vlfhtcsvfxxrx
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5109

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads