cerberus | 8fa80c5384bcb23fc9333572ede167a34f24acbbac7e189b627d8ba58c0d2db7

General

Target

8fa80c5384bcb23fc9333572ede167a34f24acbbac7e189b627d8ba58c0d2db7.apk
Size

3.1MB
MD5

2b1d961b745b3d1cc9792d231efb316c
SHA1

95c4a90f8021a06435355bbb7438509bb6b92013
SHA256

8fa80c5384bcb23fc9333572ede167a34f24acbbac7e189b627d8ba58c0d2db7
SHA512

0e9f525de01085783bdf808e786a05c4ff42c07c62848dca78bcb547ad3e36a81258394dc68ad59fb01c67b2eb92ecfe1a91d33061b3e6427d9d5bb5a50fa93f
SSDEEP

49152:Fy7QoenfSYHDIyTbblnqmzxzsqqECSyOpF+kKawlN2cNXHwCzCaWlSFFpGb7TKcY:gQouxbblhzxgyBlKawXHzCacSIbgAe

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://194.163.159.65

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5054	mistake.nose.other

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/mistake.nose.other/app_DynamicOptDex/sHQA.json	5054	mistake.nose.other
/data/user/0/mistake.nose.other/app_DynamicOptDex/sHQA.json	5054	mistake.nose.other

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	mistake.nose.other
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	mistake.nose.other

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mistake.nose.other

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	mistake.nose.other
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	mistake.nose.other
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	mistake.nose.other
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	mistake.nose.other

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	mistake.nose.other

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	mistake.nose.other

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	mistake.nose.other

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mistake.nose.other

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mistake.nose.other

mistake.nose.other
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5054

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

2

T1628

Suppress Application Icon

1

T1628.001

User Evasion

1

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/mistake.nose.other/app_DynamicOptDex/oat/sHQA.json.cur.prof

Filesize
243B

MD5
dcac098af119d358497cdda2f53c4eb2

SHA1
03b7f8268f379b956bdc9d308af5a34e787198f3

SHA256
feabac91621352fcfa7e43b64b8a14435c4fa605a93f93c32f37bbbf04242064

SHA512
f316997a14ad66aabfdb0768ef056848baecb41f7a07608945efe906ca3f3dd676bb8b56e4e21a538c0f75e58f68bdccf1c0c96775372e51c81d552b946b2131

Download Submit
/data/data/mistake.nose.other/app_DynamicOptDex/sHQA.json

Filesize
745KB

MD5
f01c37c96001103bf771467324c23cd9

SHA1
795fc72fcc03987001d5cea279b04eef86f249fb

SHA256
4705e3e3dd7ce83885e4681b3c6e5930e5046a4c7490e4f9a3cae653a550e3d2

SHA512
098200742b1a4ad102cb41d2e2ca0644be2b0060599ef0a2dd4da0f744988ce8d58264a134bc6bfbaa6ae2bcaac722723cfb9f25b8350ee2848cef9887d33a6c

Download Submit
/data/data/mistake.nose.other/app_DynamicOptDex/sHQA.json

Filesize
745KB

MD5
5a4b2b997d379e8d27520de39177ea52

SHA1
86c0305bbe1a5ee143b356d3b61afac43fc00a5f

SHA256
e518a36dc6b3648e70de61db43754058f7034e3de4c9298928e076591eafed1e

SHA512
aff8583001c5af4efbe2fa941bb18fbe20d4acba7ad6df52b6bc45b8cb935ca1750ce0bf27aad58822d21cad78a362edfaa9ef12afc63e3f0e76f7c216733f03

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads