cerberus | 39d33af83cb1d553697b5b04cbde87b97b30f344a7cbeaf5b3fd0b162e170ec3

General

Target
6ff8f6df48139ad4cd77695f2bcdbf3e_JaffaCakes118.apk
Size 2.8MB
Sample240401-mvx83ach98
SHA256 39d33af83cb1d553697b5b04cbde87b97b30f344a7cbeaf5b3fd0b162e170ec3
MD5 6ff8f6df48139ad4cd77695f2bcdbf3e
SHA1 bb71c54b85da50502b2a6ee48644daa074168547
SHA512 2b4828051b35294118e1822ffd2b543422fb6c8c6f177722ee80083ecb2683a98a50c4f0d44e48f11ee9a3f9f0b946b3c396783ee9973dcde59e0c09eb9d2c71
SSDEEP 49152:Y3iglVMWbJCc9KQqBUfjcUGaiIj7nDYGQ12/wMwbiDnyRBA1wm62FnlNdBpBY9oj:YyyGWdCwRqUAUGEDWhMPnSA1wmTnZBJj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://tornacimamutxyz.site

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.alter.tool
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.alter.tool

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4271	com.alter.tool

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.alter.tool/app_DynamicOptDex/SypIWOG.json	4271	com.alter.tool
/data/user/0/com.alter.tool/app_DynamicOptDex/SypIWOG.json	4296	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.alter.tool/app_DynamicOptDex/SypIWOG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.alter.tool/app_DynamicOptDex/oat/x86/SypIWOG.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.alter.tool/app_DynamicOptDex/SypIWOG.json	4271	com.alter.tool

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.alter.tool

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.alter.tool

com.alter.tool
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4271
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.alter.tool/app_DynamicOptDex/SypIWOG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.alter.tool/app_DynamicOptDex/oat/x86/SypIWOG.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4296

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

SypIWOG.json

Path /data/data/com.alter.tool/app_DynamicOptDex/SypIWOG.json
Size 124KB
SHA256 f7d8073a9139525137b9a48ac076bf4a91901a0ffbd79ba271976a23ca48e351
MD5 0e9b258b53b293bc71b1a04717149e5d
SHA1 0abdd3f2b2eb22315a72daed09336db4835142b2
SHA512 ba3d34b18bdb15537a5a1891caac2871423f5f7adfaf1e86aca6bad70232ee4e82a31498c286f88da2213ce52b95e17cf43e53471b1df6d42d50e17b6a788920
SSDEEP 1536:4Mro9kNKp8nuPe0EIVdRpzLpzuemFRVw3uF86M0jXr8cOHZd9ZTUpX3g2+lT9U:4MrooO2uPeZI7LZt4nLE0bgFZTWg2OTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SypIWOG.json

Path /data/data/com.alter.tool/app_DynamicOptDex/SypIWOG.json
Size 124KB
SHA256 0b95d39b1f8d329a54e4362b95fb6b18bc19a54d8497b47e3c27abf1120e0491
MD5 702c7269f0754a2da293b5880f10116b
SHA1 e3796746c27a55a59a00f9c2d03f37b03678091c
SHA512 0ccafaf44a48159f536abc283a01852a640d45302edeb454494ba2477f5c3e09c95ea3f072487a18687ba72b8482628900bc210d8ca1250f6e0a216be2115627
SSDEEP 3072:pprsvs/RSeZJn0gIf4uwq56QG4itFh8Z1CA:pzgIn0gIfvwq56QG4itFEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SypIWOG.json.cur.prof

Path /data/data/com.alter.tool/app_DynamicOptDex/oat/SypIWOG.json.cur.prof
Size 808B
SHA256 66d7eaecf9272e05f92799638bace24bf224188415008665ce4d4e4f7e9b4283
MD5 a2e73a07730a8505e94ebe0e81d3f554
SHA1 998ba5849614ba5acf14ad972ca1212077134de6
SHA512 05c27a5ebefa510ab7d1ba3157f4a7121b18ddfc9b5224d0331c159ed1844b19e5691c453779cd891c1daf3d153fb717fe14f4ea5ab225eded7ba9383be1cb99
MD5 SHA1 SHA512

Submit Download

SypIWOG.json

Path /data/user/0/com.alter.tool/app_DynamicOptDex/SypIWOG.json
Size 124KB
SHA256 6987a34f8b5cefba0690fa33db8a2a0b456a0d1c84ca9e26c88c417e85fc64ae
MD5 72dc0ed65fe2c67d4c5db32ca0d09f50
SHA1 a7f3222051ba4f243281a69805287caa9fe444cf
SHA512 89125d5dd1a13af1d966b08c966fc946556708620ae5df43435bd4a056d882daed28e5c7f405446ce4adf679c65cb93ab13e7aa5d5d0a4d1dc1936f4187f0990
SSDEEP 3072:pprsvs/RSeZJn0gIf4uwq56QG4CMul287JL:pzgIn0gIfvwq56QG4Xv87N
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads