cerberus | 59f7f18ddb4e625024b726457fda42804431937d9e3419d501309e582fa73f5e

General

Target

59f7f18ddb4e625024b726457fda42804431937d9e3419d501309e582fa73f5e.apk
Size

1.1MB
MD5

94ce75f38300e5d4506e3ad1d4410027
SHA1

dd6af50b87d0fb8f738697026db7dd56a22c6342
SHA256

59f7f18ddb4e625024b726457fda42804431937d9e3419d501309e582fa73f5e
SHA512

c64f14b6f54d38224fae6a98ba2e2f813bcde388e3a28ff6318f664c05bb7143da5c77c5f6e263724f6f2850d42e3148253eec1d37eea876457565c138bfec35
SSDEEP

24576:RAtpsQXe4K0EMvFInQAmqpv7RvCvYLT49jzhdEQi2Zvxzr:RAtbe50EMvWQAmqpv70v8Tmd6Qi2xxzr

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://kaanworldmotorscamping.ga

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4805	com.nerve.alter

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json	4805	com.nerve.alter
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json]	4805	com.nerve.alter
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json]	4805	com.nerve.alter

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nerve.alter
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nerve.alter

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.nerve.alter

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nerve.alter
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nerve.alter
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nerve.alter
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nerve.alter

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nerve.alter

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nerve.alter

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.nerve.alter

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.nerve.alter

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.nerve.alter

com.nerve.alter
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4805

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nerve.alter/app_DynamicOptDex/sZdr.json

Filesize
54KB

MD5
b5c1d7446d937d10038380e1e30ac2b3

SHA1
dc1eece3b43c53cc337a736c814e1ac95f141d62

SHA256
e6dcc0fc4c02517d995ad3e61cdfc1a007747ac18613064e042525bef6f61443

SHA512
01b78bbb834067f503ac3449ea16e08b60f09fdeaf340a3f906b5b346ef5add83d5e86ac60313f05dcc21a4e81d686835fda48e8786a81baa46876dc16485886

Download Submit
/data/data/com.nerve.alter/app_DynamicOptDex/sZdr.json

Filesize
54KB

MD5
ca8efeaeea912569c7afcdbdc6a9988a

SHA1
2934c218596739578ffdcf994c154c5f0da687a9

SHA256
0440ed52d8bbacd195d1f4f5fe696cec2c7ab63d400961dcc8c4ed3c3bf724bc

SHA512
5b271982933fd732a97af8bea22337df3f60d8b85c0140c64e1010ca770c27c21e9d6f9751bfcd7cb15aa6b69dc2afe0612683c7e3e9c1542c972c6285708e89

Download Submit
/data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json

Filesize
103KB

MD5
1f63ca682468f83d0a3451b4e32a9ffd

SHA1
4e98cd15b2cb9ef7632d475b297f12cb7a1f0671

SHA256
63f4d892a9e1fcf1211d929e2e1a5ab4e9956f1cc1c9fcb4d87761d5cd3494cc

SHA512
1ab5a3307e5c85fb343d70224cccc22d9a9cf51fe083874d9f700468fa7aaed3a6c2d6025c0c8305ff92a025bfe038baca66c4cc6732fa16bce0b44060cdcabb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads