cerberus | a7901dcac5ad3e75fdb495d8cb8af75d3ef08b9b970d77b9b3a0b49b3d189499

General

Target

a7901dcac5ad3e75fdb495d8cb8af75d3ef08b9b970d77b9b3a0b49b3d189499.apk
Size

1.5MB
MD5

1a98099f11351dff5fcf9d7622c05a93
SHA1

872f599dfe33a1a27179570735b8b2987a408a7d
SHA256

a7901dcac5ad3e75fdb495d8cb8af75d3ef08b9b970d77b9b3a0b49b3d189499
SHA512

da5adf30a42afa15884233020b7ca8e0efa21167bc12da96abe2eb0b6277e1b7dcc16c9b0713da7f8ae44c7613f6f11f321a1696507bd1d299953f39006045af
SSDEEP

24576:8KMQMkwj6uSn+9Gpik0YmaWOpKfEP6zvdNi3hePcXpzc+xC1ADGWcdd+mv4D9FQu:q3k1uSnmikXa7GESzvW3IPci+AAJcddo

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://sapwatsuop.ru

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4327	com.absorb.narrow
4327	com.absorb.narrow

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json	4352	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.absorb.narrow/app_DynamicOptDex/oat/x86/IaJwMF.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json	4327	com.absorb.narrow

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.absorb.narrow
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.absorb.narrow
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.absorb.narrow

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.absorb.narrow
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.absorb.narrow
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.absorb.narrow
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.absorb.narrow

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.absorb.narrow

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.absorb.narrow

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.absorb.narrow

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.absorb.narrow

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.absorb.narrow

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.absorb.narrow

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.absorb.narrow

com.absorb.narrow
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4327
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.absorb.narrow/app_DynamicOptDex/oat/x86/IaJwMF.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4352

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Protected User Data

1

T1636

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json

Filesize
64KB

MD5
12d9f215bc4e78cf0c9940ce14233c3a

SHA1
378054b7507426caa9c5cc033b68dd60cc0cfed3

SHA256
0987a49ceadb3e104c80bb5111546fa2b9440032a9231940231a71599b21fb51

SHA512
fac0019a534261858e1006469d97cbd1e350267d8321cfc1c0f3832cfe38ca233bff00764cb288117cfd2e4c1cd7225d01b16bb9eb2645bc98e30f7727726e20

Download Submit
/data/data/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json

Filesize
64KB

MD5
48ec9478c063be4d344e8b3c23f73eff

SHA1
519bc6b6e43bb6cec854dc6ca546089a88e2629d

SHA256
28a06ffd14881b6419481db1445a322a0c13252eccc34a1c98030efb6e399802

SHA512
f19bbbdfa2a0cec0875a3701433355caa6f5f44993a73b90eb0be8ea6a3c3dab90a33f276a0ede866a57d8a548da3e6a303634871263950951f655e620d8e6c4

Download Submit
/data/data/com.absorb.narrow/app_DynamicOptDex/oat/IaJwMF.json.cur.prof

Filesize
240B

MD5
04bf9092ac55eb1ffdf721d0f706e6cb

SHA1
2b1115f09e1a776f27bc95379ef43141e795c14c

SHA256
ead151580b38dd3b36661bed27f310ecd9fed5475deaa813e8a8a5cee17eae78

SHA512
8f9ad70a2cfd3a5f8102602861a072465e7e896810f48d02c83b6af4a120749776964638ac17c80c17e972f82056de033d689551aa61f870be5084710e54edc7

Download Submit
/data/user/0/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json

Filesize
118KB

MD5
e1b838a23cdc81de69cb97b2e3ea05ab

SHA1
08353775ff15c1cf37df26136a9df86d318d80b7

SHA256
8ae7c4edc53d73054191a8c0f3096f04d382eba92e6e765e06dfe9851c239714

SHA512
44e4eace7a15b0337a2a58d07b470da6c747e9ebe97dadb4e9cfaf13a01ed504940a62cc71c02a0dfa5e10c880dc94a014feff2fbb85fd3d6389042c1f327ec7

Download Submit
/data/user/0/com.absorb.narrow/app_DynamicOptDex/IaJwMF.json

Filesize
118KB

MD5
6ce4981964f8500b60a2e03ad9c6d449

SHA1
3276dd791664b38dc6524bc11132fde0c6e53e87

SHA256
7226f32c8d167145bffae53471694806701c1b86df3e9f53df546ebf9a4d25a3

SHA512
7fddbac8577c4427cece0095ad4d23445162d69785f2c5ab3f15feb186d0722229faa50fad58e8649b1237d4f98851d34be53ae7b2e1b6074b59ad65dcf73623

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads