cerberus

General

Target

f8106603bfede22394a73d2fb0a082f0_JaffaCakes118
Size

2.8MB
Sample

240418-qev1jseb54
MD5

f8106603bfede22394a73d2fb0a082f0
SHA1

628f5fc3a684aeffb6eef6b8e7cd83c916776ca7
SHA256

c5888a824cba71e4c6ebca35aad174120f8b681e48af867dfa95ef6a4ba0dc25
SHA512

52d77a5f9f5d8099d7c2129e5de00073b49d5e8a4fd62dbc7a39a91ab92ae59c2f0e139b4e966cbd38f5d883534a15a6091735b0aaf8b4b359e40c5235b18021
SSDEEP

49152:0fyjHfCqZ0lylqy45KqoTF4qd8IGq3gSCItxJGzFauRg46JZHRT6X7scm89pW:jTDZjqNvoJTd4orCIF9zZx6ud

Score

10^/10

Malware Config

Extracted

Family

cerberus

C2

http://144.91.116.117

Targets

- Target
  
  f8106603bfede22394a73d2fb0a082f0_JaffaCakes118
- Size
  
  2.8MB
- MD5
  
  f8106603bfede22394a73d2fb0a082f0
- SHA1
  
  628f5fc3a684aeffb6eef6b8e7cd83c916776ca7
- SHA256
  
  c5888a824cba71e4c6ebca35aad174120f8b681e48af867dfa95ef6a4ba0dc25
- SHA512
  
  52d77a5f9f5d8099d7c2129e5de00073b49d5e8a4fd62dbc7a39a91ab92ae59c2f0e139b4e966cbd38f5d883534a15a6091735b0aaf8b4b359e40c5235b18021
- SSDEEP
  
  49152:0fyjHfCqZ0lylqy45KqoTF4qd8IGq3gSCItxJGzFauRg46JZHRT6X7scm89pW:jTDZjqNvoJTd4orCIF9zZx6ud
Score

10^/10

cerberus banker collection discovery evasion infostealer rat stealth trojan
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Makes use of the framework's Accessibility service

Removes its main activity from the application launcher

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3