cerberus | 3824dfa65a96dd4739a6138889e9b9583e1aa4bf0da953e752742ea30f28821e

General

Target

3824dfa65a96dd4739a6138889e9b9583e1aa4bf0da953e752742ea30f28821e.apk
Size

1.5MB
MD5

d16876c6ef3c56faf2220258d0d8f8f1
SHA1

5372e7c56d9539a636fb3b6962ac37981973d5bb
SHA256

3824dfa65a96dd4739a6138889e9b9583e1aa4bf0da953e752742ea30f28821e
SHA512

e0b9ded091c49844d0dac7eb4449007f24d780f76337e8a7710961957fef669ff5019e5b34bba2cbe073254f7043e770f48820e1d46384279c14b33de73292bb
SSDEEP

24576:AMpMZHk57T2a1HJDWq/Aqz00/J9+WqOh3IkPxqY+mv4v4mkEE5h:nmZHO7Xq8RYASv6xqY+/4XEE3

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://sapwatsuop.ru

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4222	com.wink.derive
4222	com.wink.derive

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.wink.derive/app_DynamicOptDex/cPnIQXy.json	4247	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wink.derive/app_DynamicOptDex/cPnIQXy.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.wink.derive/app_DynamicOptDex/oat/x86/cPnIQXy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.wink.derive/app_DynamicOptDex/cPnIQXy.json	4222	com.wink.derive

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wink.derive
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.wink.derive
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.wink.derive

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wink.derive
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wink.derive
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wink.derive
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wink.derive

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wink.derive

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.wink.derive

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.wink.derive

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.wink.derive

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wink.derive

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wink.derive

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wink.derive

com.wink.derive
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4222
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wink.derive/app_DynamicOptDex/cPnIQXy.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.wink.derive/app_DynamicOptDex/oat/x86/cPnIQXy.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4247

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Protected User Data

1

T1636

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wink.derive/app_DynamicOptDex/cPnIQXy.json

Filesize
64KB

MD5
437139793cda2407f6cb03d24dc26394

SHA1
a3dd129c1204d29736e52b9af7644aea5cb21b93

SHA256
269ead2c138ca04f3f4edbe9b072a73e65d31139e8dd177087731663d77697f3

SHA512
f3d2e42e8108b21a6516ce4f03983d9b2c09f88b624cc9c2c755f8522788abf5fba541a6bf46530e0e2c9f33b6e58e2a3c591894b08305f95377aca7941752a6

Download Submit
/data/data/com.wink.derive/app_DynamicOptDex/cPnIQXy.json

Filesize
64KB

MD5
c46c1b535fcaaf55cc404e2789c10439

SHA1
7bb475a4f67b4cbedc88152b263c620b8c7e7f51

SHA256
cd6ca1a9ef96cdab393e015846ec1e69a3e14139b7c2dcc11eac73786e945ef0

SHA512
dd581f69581947097e546418fc9755ec0398eaf906c83cea38619e623d3f2e50fcd82e5b165ca7186e5a19105c1fdadf331cae7fc687c5d2e4ffbc83e6d48a61

Download Submit
/data/data/com.wink.derive/app_DynamicOptDex/oat/cPnIQXy.json.cur.prof

Filesize
228B

MD5
59903036e683a0072179e0bddd32add1

SHA1
96f56611cd956b161d57da2c8a6dee4d159c2e26

SHA256
7cea57a105be2d3284ef04b99b186a668ab245826164cdfe701f6d87f92869d8

SHA512
9ad896ad665780a94350eab46f0c1484709705645377954b04c1204e302ce4011bb6fcafdcf3511db083c6eac0fcb8303d392906f5f0d7626203bdfcc79f94c9

Download Submit
/data/user/0/com.wink.derive/app_DynamicOptDex/cPnIQXy.json

Filesize
118KB

MD5
e1b838a23cdc81de69cb97b2e3ea05ab

SHA1
08353775ff15c1cf37df26136a9df86d318d80b7

SHA256
8ae7c4edc53d73054191a8c0f3096f04d382eba92e6e765e06dfe9851c239714

SHA512
44e4eace7a15b0337a2a58d07b470da6c747e9ebe97dadb4e9cfaf13a01ed504940a62cc71c02a0dfa5e10c880dc94a014feff2fbb85fd3d6389042c1f327ec7

Download Submit
/data/user/0/com.wink.derive/app_DynamicOptDex/cPnIQXy.json

Filesize
118KB

MD5
6ce4981964f8500b60a2e03ad9c6d449

SHA1
3276dd791664b38dc6524bc11132fde0c6e53e87

SHA256
7226f32c8d167145bffae53471694806701c1b86df3e9f53df546ebf9a4d25a3

SHA512
7fddbac8577c4427cece0095ad4d23445162d69785f2c5ab3f15feb186d0722229faa50fad58e8649b1237d4f98851d34be53ae7b2e1b6074b59ad65dcf73623

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads