cerberus | 49e565f65f2f7fb4b22cc00387159b0f9cb93aed500f4c0f1e53534c44e4ef39

General

Target

49e565f65f2f7fb4b22cc00387159b0f9cb93aed500f4c0f1e53534c44e4ef39.apk
Size

1.5MB
MD5

e05d0159fce4ff4b17d36a41d3e352c5
SHA1

083df4938ad365add2edaf7e92a15a45666b96a0
SHA256

49e565f65f2f7fb4b22cc00387159b0f9cb93aed500f4c0f1e53534c44e4ef39
SHA512

a643ce0bd2826ad0661f6c476b378cd4474f5466af9890b50ff9a419dcee15b1534c40bf75643c72879203f742194516c739fa5a3fc8f913125988c2e00cf0d6
SSDEEP

24576:tMwMhu5Mhuocn5TCilraZdOS7txYOYT1F3e/Fz6V89vkTCkLB7KemGsWhWm0Tt:yXhiTCMFKdOF3uFzFsTCkLBOemTWhL05

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://sappzaebiservak.ru

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4249	com.trophy.element
4249	com.trophy.element

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.trophy.element/app_DynamicOptDex/RQFyfKH.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.trophy.element/app_DynamicOptDex/RQFyfKH.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.trophy.element/app_DynamicOptDex/oat/x86/RQFyfKH.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.trophy.element/app_DynamicOptDex/RQFyfKH.json	4249	com.trophy.element

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.trophy.element
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.trophy.element
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.trophy.element

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.trophy.element
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.trophy.element
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.trophy.element
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.trophy.element

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.trophy.element

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.trophy.element

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.trophy.element

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.trophy.element

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.trophy.element

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.trophy.element

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.trophy.element

com.trophy.element
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.trophy.element/app_DynamicOptDex/RQFyfKH.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.trophy.element/app_DynamicOptDex/oat/x86/RQFyfKH.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Protected User Data

1

T1636

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.trophy.element/app_DynamicOptDex/RQFyfKH.json

Filesize
64KB

MD5
0a4c81ad3f52b3b19ef38cafd13c3221

SHA1
3121439a939a29d8fa3693d651d96debb318aa78

SHA256
9efc00796df7e7cf9c64122711bbba06c6f07c29e2a1c380c1157a0dfd82bf65

SHA512
27e94bf4716d0970a4a2f28c5996924cb7a70796a666cc66b0a2e386bae06e15193f94ed440de0b0155e0e8f877e0feea350ba9e847f50f0e4fe0f547321ba1f

Download Submit
/data/data/com.trophy.element/app_DynamicOptDex/RQFyfKH.json

Filesize
64KB

MD5
f34fa19fde423a80105130d661070a64

SHA1
8b2fdc96f8b11e3bc0066fc439621078eb0e57f1

SHA256
e8bf45c29cc7911361b696512f9c61a2dbf00b7e9915d47c52d736712a1f21bb

SHA512
48fe0f01df10d2e3617355d9044e286074d2ae3d2b412fd517bc0c4a7bc91fb55d310313b61e5969f8f3ffc6836d6f62fbef0e8b38a4e5327a97c53881455ff6

Download Submit
/data/data/com.trophy.element/app_DynamicOptDex/oat/RQFyfKH.json.cur.prof

Filesize
244B

MD5
0193b9268cebd0bf1a489bcfa65dbdfb

SHA1
5bb730a8ba38657ede4a8b6ce362d7da5a602b09

SHA256
141a2c3a6e7784b8f63c6f50b27a2a34ec11a8db2e8ea0bf3d77470e7d618e70

SHA512
ca30062d406bfa9226877cabf4533418515c719814159dd734f0952aff0c562ad309a2e79cac4656aa6502325a74087ce9f9809b6c7be121c6118a8222888c89

Download Submit
/data/user/0/com.trophy.element/app_DynamicOptDex/RQFyfKH.json

Filesize
118KB

MD5
2aebcc1ef9c346eaf531c435cad95daf

SHA1
53735f314108e7e40e7ac8c66db993ad24354efa

SHA256
f37c541ec5463bd936a031064cfbbca4200fa628243d9036796cfa2f658d224f

SHA512
180ca8003956cd7b4a12fe5202f52deaebca9e27b18e192ba055853299198f5192bd58e16bdbbefbe8ee826ba7b70225c7d1b4b764fae0a7e48ee49ca8a38459

Download Submit
/data/user/0/com.trophy.element/app_DynamicOptDex/RQFyfKH.json

Filesize
118KB

MD5
08f818e7b9a7b3d91d0c64db2adfe623

SHA1
1e17fc5a6bd7d29307dd04df8bbc4edeb9680e1e

SHA256
252acf5a3ea28210b475900263cc192c3422984522b5e7e50e7ac18bd2e579e9

SHA512
6177922b522f05f44ad45c82d9719bf718e9bf44fcd8354f01339feb0ccf657d5ffcc4060cd37544f116ad55e28c3a64b31f31ab5b2613a935229d595fbcfa36

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads