cerberus | bb1d6cade8012aa46d5f2ba15a3cc9db3f2fb168717fb3b88450ca4c44a76174

Analysis

max time kernel
150s
max time network
162s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
26-08-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb1d6cade8012aa46d5f2ba15a3cc9db3f2fb168717fb3b88450ca4c44a76174.apk
Size

1.7MB
MD5

90f62a3a2aad45057e8fbab1a0454ef8
SHA1

985a098532ec923e518895cab703d0d74bb77bac
SHA256

bb1d6cade8012aa46d5f2ba15a3cc9db3f2fb168717fb3b88450ca4c44a76174
SHA512

8dffcf2117aa58bf352e6362be275c07f49a94f79d3c278fd2ce7783fa9e84fe2182b996b2f0b6bf857b5aa267200fe787763bdc7c8d7022c029807887d1bd0c
SSDEEP

49152:hyw96K+7qiQHXv31V7iuFvT2izL+9em6WhLaQ:hyw96K+sPiKqizLAemZV

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence privilege_escalation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://94.250.253.26

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4268	com.flight.worth
4268	com.flight.worth

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.flight.worth/app_DynamicOptDex/lRcGnG.json	4296	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flight.worth/app_DynamicOptDex/lRcGnG.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.flight.worth/app_DynamicOptDex/oat/x86/lRcGnG.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.flight.worth/app_DynamicOptDex/lRcGnG.json	4268	com.flight.worth

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.flight.worth
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.flight.worth
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.flight.worth

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.flight.worth
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.flight.worth
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.flight.worth
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.flight.worth

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.flight.worth

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.flight.worth

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.flight.worth

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.flight.worth

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.flight.worth

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.flight.worth

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.flight.worth

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.flight.worth

com.flight.worth
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4268
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flight.worth/app_DynamicOptDex/lRcGnG.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.flight.worth/app_DynamicOptDex/oat/x86/lRcGnG.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4296

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Input Injection

T1516

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.flight.worth/app_DynamicOptDex/lRcGnG.json

Filesize
35KB

MD5
ab826c1dad801d59df8efe06388f878e

SHA1
5e18f1d63811e6e58cb8e32465f5e847a9162521

SHA256
b8434b61901c55b3985d79bb245dee8b6c84b7289c697999d264c71afd6cd6d7

SHA512
69660e1e69a856a7f20f3f74d59d02cafbcca2206cd921d17a26ec6e8f2a5df88d744ed917dfa15c8f1b143d094e5782188ea7f919f1ab0bf8e3b50843c5912a

Download Submit
/data/data/com.flight.worth/app_DynamicOptDex/lRcGnG.json

Filesize
35KB

MD5
f74d176c46c7c3b7f6721f9b87981584

SHA1
3719d964c7e67cd7bc518edc9d3aef927ef55e6c

SHA256
c3e5384a342effbcd76dbeac02a52b2085608967b690bbc7868480313daa2184

SHA512
939f42e9f9b0ac40b920bbb549e32de96756270ce3ec93e59e2dfa14ed32816599f7fe9e993bc806fe4313c723f9e0302cc746395b19f9f28a447da105c0b3ca

Download Submit
/data/data/com.flight.worth/app_DynamicOptDex/oat/lRcGnG.json.cur.prof

Filesize
201B

MD5
32a327e063c2b1a2d7937e8a3f59a10d

SHA1
e5dbafb5a1cc416603849437245c88103c88171b

SHA256
102cf6669fc866059baf3f188cd7ad4fbbf8d51ffa8a67104679bb340cb07681

SHA512
e81376b67b46e806312884418192b586e4d1484ff499b83c6e7ae24a5340a0c82853cb3b62336b9a4e59bf8c6572ffaf27adeb59ffcad69a9c244a62a2392b31

Download Submit
/data/user/0/com.flight.worth/app_DynamicOptDex/lRcGnG.json

Filesize
77KB

MD5
9dfa580aa93694ae97b83ecb5cfa9ff5

SHA1
b17c51cbd1dad8b069e2ac3adab7fccfd6bd624f

SHA256
caaa953fc8d5eb5d2cbac6e280ed76c7e3ddaa2f0f4eb2ed5e7d58b7b7015ddf

SHA512
22c51103d9bdf7997ccb6557c92613f431b9c643a1825d4264fd4767a0f1f8e66b8f2719ccbcda1bf5aae2c9448729212e722b6d9091a4f1c7eb6cb6bdb034fb

Download Submit
/data/user/0/com.flight.worth/app_DynamicOptDex/lRcGnG.json

Filesize
77KB

MD5
fbfec32963eec74794d898179aee8b56

SHA1
cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

SHA256
d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

SHA512
f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads