cerberus | 2ec6a138a4a81be80cd65d15cb05f0b86c57aa1521fc02c8d34ba7ac16e131f1

General

Target

fa67c0a6efdbbea22f1d48864ca31377_JaffaCakes118.apk
Size

2.6MB
MD5

fa67c0a6efdbbea22f1d48864ca31377
SHA1

bb933c5a089ab1a99c158eb9f6ba0619235094fe
SHA256

2ec6a138a4a81be80cd65d15cb05f0b86c57aa1521fc02c8d34ba7ac16e131f1
SHA512

6a0469d01f2904849b8a326441587ec94b7cb6a6f90b3c6731ba372d9dace8876f3836a752a0a08390e5835f5290633568d227ab81c813230585856e687f2468
SSDEEP

49152:iNgKI7ZL11jzq+frOSaVrCsDfyV2zzo04/ef+QtLMfOsWM5kVz6cH:iNgzdXqAa5ZzyV2zb8eflOfUM5g60

Score

10^/10

cerberus banker collection discovery evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://161.97.68.93

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.urban.relief
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.urban.relief

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4203	com.urban.relief

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.urban.relief

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.urban.relief

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.urban.relief/app_DynamicOptDex/bLOM.json	4203	com.urban.relief
/data/user/0/com.urban.relief/app_DynamicOptDex/bLOM.json	4234	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.urban.relief/app_DynamicOptDex/bLOM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.urban.relief/app_DynamicOptDex/oat/x86/bLOM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.urban.relief/app_DynamicOptDex/bLOM.json	4203	com.urban.relief

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.urban.relief

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.urban.relief

com.urban.relief
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4203
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.urban.relief/app_DynamicOptDex/bLOM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.urban.relief/app_DynamicOptDex/oat/x86/bLOM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4234

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.urban.relief/app_DynamicOptDex/bLOM.json

Filesize
124KB

MD5
80bee2149ae5c480595f2482688abac6

SHA1
efa4a07e93bffbe3e0a8de75858adbf286465b80

SHA256
e1715399bdb656d494bb59270f7aa3b5e8f0b90c21f3327cb3f4d88c166b8bf9

SHA512
de8474b54cb6677d2e3607c26abba639e81432aadf00170223eb273bb235cb9fd1cc9841659d1453a722ce59557ccca89d13ef64b9e0b65ee90fc156089ea55a

Download Submit
/data/data/com.urban.relief/app_DynamicOptDex/bLOM.json

Filesize
124KB

MD5
1e49749a348c08ca2b1b9cf6e8daec91

SHA1
0a4994c318c22bebc844d307e566d39ae3efca03

SHA256
3d448e30e56e2e5c422b2d967b097c8372ac3b5514bbc2d50f1f409761605a4c

SHA512
131336463b196339e974d36de9c882400c05940d57d6816c9784fe3aa83f478ace0b051f9ad78ae28b466506b8de1131313c02a66a4af76797976ad8d7d27fad

Download Submit
/data/data/com.urban.relief/app_DynamicOptDex/oat/bLOM.json.cur.prof

Filesize
814B

MD5
e0f68c59decc57ba9b100f62e09690c0

SHA1
508c39145a5e65c5a09aba8a6ecc6de6ca97285b

SHA256
8d5a59a1233e0121fdfc6de60c3ba018f9dedfaa3ec8bd59d8dd4bfd78a64c14

SHA512
daa81f4987f61ae0bcedef84d6e8d06eba12ec1bb055cb301386baaba1a9079ec5dfed10b67d03f20134746716a2502606ffd9be0d2df8c93cad0fa5998b783c

Download Submit
/data/user/0/com.urban.relief/app_DynamicOptDex/bLOM.json

Filesize
124KB

MD5
0bf7999a429bf639342f2cd738b918a4

SHA1
32b7d31a60da07c1e96c2e6f6722364563b47815

SHA256
8e9c48297d9207790a372ac9cd5f09442382ca267b01779e50d261641e2f0558

SHA512
a47371759954c011678a2d59565007a46546e06468a6c9de6907e6cff03d921d2a53c750618a701b00768ee4e33ba48fbe303894378f6dd8a5cdcb6fcfd2ba3a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads