cerberus | 74bbdbb6389b68770829c5919af9e5383cb62cdf1c28ec350aa65e1f9ef40c35

Analysis

max time kernel
79s
max time network
154s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
17-04-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74bbdbb6389b68770829c5919af9e5383cb62cdf1c28ec350aa65e1f9ef40c35.apk
Size

1.2MB
MD5

85191349e5dbcef9645bbe79ca53170d
SHA1

e8d605ce5344123d5455e820b374cb841dabedbd
SHA256

74bbdbb6389b68770829c5919af9e5383cb62cdf1c28ec350aa65e1f9ef40c35
SHA512

ca054aee9fe08e60011f903a01e2229568cb8922ef22463ed9a0886840c7fb48b7348444e2e8927c77576ff579992be83b75b174e11537af6026a1c79e3cb18b
SSDEEP

24576:F7jLi+eZW/Hq5G05Yu40QwXPFbZ4zzzALpIpMvbN7xAC7KQqvjta0ehp1411J:xfeo/Zu40QGkkLpJvkC7z6B/eFa

Score

10^/10

cerberus banker collection discovery evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://185.246.67.79

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.budget.hawk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.budget.hawk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.budget.hawk

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5087	com.budget.hawk

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.budget.hawk

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.budget.hawk

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.budget.hawk/app_DynamicOptDex/QwNDdlS.json	5087	com.budget.hawk

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.budget.hawk

com.budget.hawk
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5087

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.budget.hawk/app_DynamicOptDex/QwNDdlS.json

Filesize
34KB

MD5
e96129c3fa42dc0dd0533766190295a0

SHA1
c269e47b9e10da29a48761a581c248913786e541

SHA256
d33ef51d04a1d7f93f581225bb2bcfba019acda994ea901035c96deba2bf5700

SHA512
f3230d389da63bff2252f7593fefd0a5343807a02a5b1c23d06cd228a8a282c918d772d10f3a2068862e83667fff381d7d7b1666fddd2b3e8bf923a362ff6fc8

Download Submit
/data/data/com.budget.hawk/app_DynamicOptDex/QwNDdlS.json

Filesize
34KB

MD5
e41da5a3a6fd73cbbb71bb419d744385

SHA1
b32da4cc0d8ef4a13c0f1c9c243a28c82329d466

SHA256
a3b308b98cbc1d2638a6ac847e46f1020a46f600fb93d43b94d4a810aaec0d6c

SHA512
6067b0c8905c045fcbf78c189cb3fa7dd91164aba161765721c492f1caab462b0ba7f31b2b8078c846dbdbbf98e53657f5f246e61ae2fe8a40a80ba278097c18

Download Submit
/data/data/com.budget.hawk/app_DynamicOptDex/oat/QwNDdlS.json.cur.prof

Filesize
227B

MD5
4f9d366c290ff4af6679fb5cc307260c

SHA1
a45100d9883db9d4a66eb5f69a18186f6139749a

SHA256
1cf8ccd20533306bc932ebcc7fcd2eca7b9e7bfdd25a58dec1c7c06c6c9b888e

SHA512
564ae2e89d18e2b0b340e6c41b665eae19d0d4f705f583447cbd3bdc3c8c1d14f6bd512ab4ef473ba34fb6e215e81301d40dfa9ec24544646a15eb685ad3e354

Download Submit
/data/user/0/com.budget.hawk/app_DynamicOptDex/QwNDdlS.json

Filesize
76KB

MD5
144803dca77bf7395aacdfe4f3be0a46

SHA1
620e9463f8ee64a4aceea2d22d9e6b39873f4f7f

SHA256
bed55ec7aa193c05ef742f0ef03762a5e4d9e3476234a7c0e658421713294a16

SHA512
eb2c9801d2d8804c5603777ee536d856e2fe76f19c903707cd4020076c6866a40262c558b05727cfbebdd88da76413dff9969fa2d26e8abc01e37a13ea6c1c1f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads