cerberus | 6208a4c0def1a46852a98bdd37621568ef64be7498d50a7f132faa422ec4c68b

General

Target
45f493e525bbe41865d76d3f60d22bde_JaffaCakes118.apk
Size 2.5MB
Sample240330-2fgp4agg58
SHA256 6208a4c0def1a46852a98bdd37621568ef64be7498d50a7f132faa422ec4c68b
MD5 45f493e525bbe41865d76d3f60d22bde
SHA1 32a1fb26ef90f64411cc25d30a868933c8c56597
SHA512 f6bf56e1a8a2017d745f07f8b6697d470dba8b64a81fae62000ec9fe474bea117a45db4b2b2dc0b3245b1b035ddc878360326deb16392b9dfd4009ed33005712
SSDEEP 49152:NhpWv0OvsuOV8H6SfYjoj0v9riRKbNRjQjXL8GarkiZb:NhAPi8HlQjPi6RIL8GUkiZb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://51.132.252.42/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.enlist.scatter
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.enlist.scatter

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4281	com.enlist.scatter

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json	4281	com.enlist.scatter
/data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json	4308	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.enlist.scatter/app_DynamicOptDex/oat/x86/xaJetlG.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json	4281	com.enlist.scatter

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.enlist.scatter

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.enlist.scatter

com.enlist.scatter
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4281
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.enlist.scatter/app_DynamicOptDex/oat/x86/xaJetlG.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4308

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

xaJetlG.json.cur.prof

Path /data/data/com.enlist.scatter/app_DynamicOptDex/oat/xaJetlG.json.cur.prof
Size 814B
SHA256 058d5b71faba00fe9dc280170bfd8436f55bb9f8c796b1dd79833fb46e620148
MD5 4ddfc7d7a25e0bb886d3e1f1390f2ae2
SHA1 610f76925dd25ddb8cf1205bcefbc3a70974c1b8
SHA512 de016deba46b8904ba160ed3bfa57eb4ed54f281ae4fa30df96b752b93d22708aa1d7900d73a71986e920a57a782d0f501fc077f1cf17ebabadf81ff52d808e1
MD5 SHA1 SHA512

Submit Download

xaJetlG.json

Path /data/data/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
Size 119KB
SHA256 0ffc884de89ed7fb976d19b452375b9af90a9a4565db3f18c7d0c079c59c879d
MD5 df12f4f43e7d8b306fc74323b93ce1c9
SHA1 4ff0e550885d803f03585ab2c4fe708882f8652a
SHA512 7da67ca56bad0f1daaa526d8dbdae40c0a24524d3718a9c4cdae3d73acb480fa7d9e4bc17ff4239060436819e280f70a24771a017a8c6282d0a08664c227fa91
SSDEEP 3072:dYmjlXEwpOuU0jukrErXu8Jft3AZAXtL1Wtd7AGlyPT7eokF6:dYmqwouUqukATu8JfpAKXtLCd7TH16
MD5 SHA1 SHA512 SSDEEP

Submit Download

xaJetlG.json

Path /data/data/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
Size 119KB
SHA256 32e7e25d2484d0dfd9f1b211c0617d170d630d33a3a7343de4623e2002d60cde
MD5 c0bd3ca742af2bd903c0a7a032323e89
SHA1 892f8dfef740d2c50a42c1e1aaf683a83087b7ec
SHA512 c07c2f534a1c1923d051b4c0f376b24135ccc597df0a368daeb2d347cfeb870acdd051ceb93cba2556844f1b3f758a4a46c908a469d01cac55d81806fd104988
SSDEEP 3072:h871fxC7szcy4K9MJVOe6QjJ27ay4dzODp:h8jZmUQVkaPzc
MD5 SHA1 SHA512 SSDEEP

Submit Download

xaJetlG.json

Path /data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
Size 119KB
SHA256 51f16210853e5c8ced735f882e21d2f191ad347001d8145020f8a8846c9d5433
MD5 f778e89ebadf8779b839b4a9f97c6ad5
SHA1 80af3788289544a7f2531acca6a0cdf22a3b6c89
SHA512 49716929677cf279cbe4f0b1b3c5a11b1d474bec0afe3b50147bd681fc1397a9eba199f6d4a4f49e772322513e36b89d67b73e39698235eabfca598b454bfb33
SSDEEP 3072:h871fxC7szcy4K9MJVOe6QjJ27aymKwUCd+7jDp:h8jZmUQVkai5CdI
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads