cerberus | e8b591d2678800298512295002a936d4850bac44d4f76908b38bb2b616ca2ff6

Analysis

max time kernel
73s
max time network
158s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
28-03-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c266c61ace74fd4950d361b023f0265_JaffaCakes118.apk
Size

241KB
MD5

0c266c61ace74fd4950d361b023f0265
SHA1

63c4d87d4496484375d708e808859e4e511eea36
SHA256

e8b591d2678800298512295002a936d4850bac44d4f76908b38bb2b616ca2ff6
SHA512

60535f079cdb9dfc62979aacf4dfa6ca3a4117152b7c46cf5946bd3cc93eee49acd513b1cbe471efa9094cf1c73e31576596276681daa498053551cdbf28c405
SSDEEP

6144:ehh0TJcGk38D0LHZ2ljU4DQvsAA46cWNORuVBAP40HWNOR1o0BABl:eH0Ffk38D0LHIj7DtAUNORu8PeNORMBl

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

https://hayallerimizdemiyalanoldu.com

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.vscsals.ogteuluecljooplc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.vscsals.ogteuluecljooplc

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5034	com.vscsals.ogteuluecljooplc

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.vscsals.ogteuluecljooplc

com.vscsals.ogteuluecljooplc
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5034

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads