cerberus | 1831495570c780ad7fb2bc7e1fc6c3ac2cfa4cf3ac0621112473599ce006dd8b

Analysis

max time kernel
13s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
29-06-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1831495570c780ad7fb2bc7e1fc6c3ac2cfa4cf3ac0621112473599ce006dd8b.apk
Size

1.6MB
MD5

6a1d6665665378b51fcb07e4fa9e4faa
SHA1

42c5255100f83b51e02237d899d95b4c80f996cd
SHA256

1831495570c780ad7fb2bc7e1fc6c3ac2cfa4cf3ac0621112473599ce006dd8b
SHA512

56616d59057277167c6aaf512716d0867444b2254f1c70b2bbb1308b2eab227c79167cc7de33a954cc02f90f2d1928caaca47e41c0748fde6c7ce0a17b747deb
SSDEEP

49152:u+6VmaCA6WZzwSiMIeInIO1mH7Ng5gjtu:ukaCA6Wef3PnIpNg5gJu

Score

10^/10

cerberus banker collection credential_access evasion impact infostealer privilege_escalation rat stealth trojan

Malware Config

Extracted

Family

cerberus

.urlConnectPanel.

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4480	com.example.mmm

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mmm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.example.mmm

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.example.mmm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.example.mmm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.example.mmm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.example.mmm

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.example.mmm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.example.mmm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.example.mmm

com.example.mmm
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Tries to add a device administrator.
- Checks CPU information
- Checks memory information
PID:4480