cerberus | 1b4f0c4cb74737a13cd7c171abfb23b628b68d5a53ab95658d573f11c0a59bd6

Analysis

max time kernel
42s
max time network
149s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
02-04-2024 14:01

Target

8e8b67786007492adb2f13cb70978ee3_JaffaCakes118.apk
Size

2.7MB
MD5

8e8b67786007492adb2f13cb70978ee3
SHA1

e12e8d2100af4ef4c333081c18777eda783b72fa
SHA256

1b4f0c4cb74737a13cd7c171abfb23b628b68d5a53ab95658d573f11c0a59bd6
SHA512

43bcea92a32858890269b14fbf554980cffd18809994b20e26fad95f6798a22923ba2d04f6a2a8a757d3667527d4a94b7a3440b6bf52e66c580c64912363ae37
SSDEEP

49152:vfL6SRbjiqCkcdp+uQhGTnksk+AKohZLVosriwaTt6ug3Y/64:vf2cjiq5cz+hhGzSBPgwaco5

Score

10^/10

Family

cerberus

http://20.90.106.208/

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.exhibit.anchor

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.exhibit.anchor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.exhibit.anchor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.exhibit.anchor

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.exhibit.anchor

pid process

5112 com.exhibit.anchor

pid	process
5112	com.exhibit.anchor

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.exhibit.anchor

ioc	pid	process
/data/user/0/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json	5112	com.exhibit.anchor
/data/user/0/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json	5112	com.exhibit.anchor

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

com.exhibit.anchor

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.exhibit.anchor

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.exhibit.anchor

/data/data/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
Filesize
122KB

MD5
f5c4ed8758f9ad204339c48bdeb39644

SHA1
42218fd9f62772d98634cd9bd592edc7b60a72c8

SHA256
9692850446b580104fa701969efce73c47b8143ef2716f27091e8bcf4596e754

SHA512
0b7dd121f3d31d7f1314e0c29014f9131af6d266d5e0b1e876fca8961c91ae888274dd75e72c24c95fba99c1f8de656e43cf2c70fd21edd826cc3fe7148079a0

Download Submit
/data/data/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
Filesize
122KB

MD5
ef1c5b2f9ec03596eb1368bf705700c2

SHA1
a4e967c58b926e321f6a185ad7c50794be90788a

SHA256
8aceed7c6b4962fa92791c484a54baefaa071d81812269dd0132f3a0e25883af

SHA512
58fb1ae4516d18540de6ebae340a59edb3fde454ab5926b3c8e86a9ccc961d73f6d2273aa9f3a3846d0eff16c75900fa89a438d7fd55a6e1d262121e730e907a

Download Submit