cerberus | fcd05b786c0a52a81683dc6ff537e3409bbd3a865129799ccf1be3477bf11ecb

Analysis

max time kernel
75s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-10-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcd05b786c0a52a81683dc6ff537e3409bbd3a865129799ccf1be3477bf11ecb.apk
Size

1.8MB
MD5

d93aa844d1efd467a852197becaaeba5
SHA1

86f9db683a8c5c73b680fb5bb4c657fe7a24ee92
SHA256

fcd05b786c0a52a81683dc6ff537e3409bbd3a865129799ccf1be3477bf11ecb
SHA512

2da028a18a7dce27bd32d280ffcc8ca64ff4c85f615aaf38314d7ed371fcd8c0266b35251a999354daefc0f12c312164870ecc643610f89c9f0674bb025959fe
SSDEEP

49152:1ZxjSSRkcXX2No3c9R889VpHuFT1M7HL52emrWhLko:1bZ9X2NucH8gZKC7HLEemKP

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence privilege_escalation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://94.250.253.26

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

Processes:

com.proud.first

pid	Process
4258	com.proud.first
4258	com.proud.first

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.proud.first/app_DynamicOptDex/oat/x86/AUFD.odex --compiler-filter=quicken --class-loader-context=&com.proud.first

ioc	pid	Process
/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json	4283	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.proud.first/app_DynamicOptDex/oat/x86/AUFD.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json	4258	com.proud.first

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.proud.first

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.proud.first
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.proud.first
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.proud.first

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.proud.first

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.proud.first
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.proud.first
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.proud.first
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.proud.first

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.proud.first

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.proud.first

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

Processes:

com.proud.first

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.proud.first

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

Processes:

com.proud.first

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.proud.first

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

Processes:

com.proud.first

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.proud.first

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

Processes:

com.proud.first

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.proud.first

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.proud.first

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.proud.first

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.proud.first

description	ioc	Process
File opened for read	/proc/cpuinfo	com.proud.first

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.proud.first

description	ioc	Process
File opened for read	/proc/meminfo	com.proud.first

com.proud.first
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4258
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.proud.first/app_DynamicOptDex/oat/x86/AUFD.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Input Injection

T1516

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.proud.first/app_DynamicOptDex/AUFD.json

Filesize
35KB

MD5
f777d7fbf39198aa0b0240b7ede57446

SHA1
c19e269a03ef0a1adde8fc6a73c1abe0fbbc9f4b

SHA256
ea2b839d7a79476eed3b91618d2f86f18867560d02aefd3ab4deca4a18c4a445

SHA512
e186959e4ea03986bc071a4f892762db8c29a3a461223b09cbb3dcb57939f1c00ae441ed2b62ab93e0294282983daf9e8c7a0221287fefe47a791997f83676b4

Download Submit
/data/data/com.proud.first/app_DynamicOptDex/AUFD.json

Filesize
35KB

MD5
bbc054667b524688c5a80f1055ecafec

SHA1
8a16632430608f8337a1a3be56d9efd93edf2f4f

SHA256
08e3325835dbb04f0cf09c12b8c69a053d19e71abaa71359c93947d459bb14b2

SHA512
d187c7035166933f616eac3995123ec632df77ac0a0230af7e78c3adcc772e90212ebbc4c1685ac7c6ddd8abb4bf84f0f385ea0b8b0c133d9dc0b7b503327c10

Download Submit
/data/data/com.proud.first/app_DynamicOptDex/oat/AUFD.json.cur.prof

Filesize
209B

MD5
d5d940a953fb19a75abdde6805a28d6a

SHA1
fa29f8b5a0f35b8ead174e37a43756f37cf52566

SHA256
a7a27633bb90a32f03d3c2d9d10896ec89190b230df13b2c33482807f5fb8db0

SHA512
3535d25faabe5990dbe87e7eca51ec1156cc32b0c3290f0e3ee6028690bcaf35dc2e2dfae20f3ffcf07626ad140fe55445a3b2c3d08198db00ca46f59e99beb4

Download Submit
/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json

Filesize
77KB

MD5
9dfa580aa93694ae97b83ecb5cfa9ff5

SHA1
b17c51cbd1dad8b069e2ac3adab7fccfd6bd624f

SHA256
caaa953fc8d5eb5d2cbac6e280ed76c7e3ddaa2f0f4eb2ed5e7d58b7b7015ddf

SHA512
22c51103d9bdf7997ccb6557c92613f431b9c643a1825d4264fd4767a0f1f8e66b8f2719ccbcda1bf5aae2c9448729212e722b6d9091a4f1c7eb6cb6bdb034fb

Download Submit
/data/user/0/com.proud.first/app_DynamicOptDex/AUFD.json

Filesize
77KB

MD5
fbfec32963eec74794d898179aee8b56

SHA1
cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

SHA256
d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

SHA512
f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

Download Submit