cerberus | 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889

General

Target
7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.apk
Size 1.9MB
Sample241108-3exwcsvmbk
SHA256 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889
MD5 8f582084127a364695aa007925f74065
SHA1 62a27bbacee4314e3fbf99777f3be0eb4c30b158
SHA512 79b718cddecb321eee1464d54a32398690acc92c88faf0dec2a44fe23dce606382fdf033b3542c913ccd35174a78ffd466b246a38e4da0505da91ef8f3957d08
SSDEEP 49152:D68Y3e+Cj1Z9KoKndF0KP0J0801fjSRZg/60dmcl1dIpkJgRh5HH:D68b+IZKbjSM60CMeHH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://mtrfff.ru/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4971	com.engage.balance
4971	com.engage.balance

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.engage.balance/app_DynamicOptDex/cqRnt.json	4971	com.engage.balance

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.engage.balance
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.engage.balance
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.engage.balance

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.engage.balance

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.engage.balance
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.engage.balance
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.engage.balance
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.engage.balance

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.engage.balance

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.engage.balance

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.engage.balance

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.engage.balance

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.engage.balance

com.engage.balance
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

2

T1628

Suppress Application Icon

1

T1628.001

User Evasion

1

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

cqRnt.json

Path /data/data/com.engage.balance/app_DynamicOptDex/cqRnt.json
Size 64KB
SHA256 26b311e2d028cf11e92992e116dd194707a5fe6c05156e62dc6b35f41fdaa445
MD5 3ed422ca54b4434ae8dd44e213b27e44
SHA1 94bd931df2d62c5363027e8ca96b2b7294752c2f
SHA512 15f027de7ba8e61a801c543d2a793e8e9644e02705070f54d776d650f1110a983b23533a24d2d86466566553fd4fed652052f9cdc0ce109d6731ec77991f5e9d
SSDEEP 1536:AKktAvd5SgW1AgniVw7CLyLPGciCLOvSdzrmBE33ZxHTeG1:BUIdpW1Au8QPdUvS2G32G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cqRnt.json

Path /data/data/com.engage.balance/app_DynamicOptDex/cqRnt.json
Size 64KB
SHA256 394c2a191f6f21c5f61c6fe7e71a0664765db20ce51a8027b76911ebd02de560
MD5 38784e81c7eec5c91bebc5cf4db4180f
SHA1 dba251ecb631664df220d24d2a9613853f31b74e
SHA512 af4e8b63f1b7b1868636ff4db302eb5bcfdcd8568c0af499f32502c061883620401c14ca6a5c0061abc051d87ae3becd9ae5af1ff13c2ceccb83ba63052689b2
SSDEEP 1536:5/Vu321N+nHH2nksP2OBAe69toMhIw39r50ps:hVu321JnkQAe69ykIw39rGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

cqRnt.json.cur.prof

Path /data/data/com.engage.balance/app_DynamicOptDex/oat/cqRnt.json.cur.prof
Size 241B
SHA256 ffa862596cb8c203c61f0b64ddd02dce09f259cfa28aad420f6bc6155c0e41ff
MD5 6ec0b40dda153178f9ee80a3b21fdd1d
SHA1 b92dc97e2b37953e6c043d9f240e12b69db64159
SHA512 834d5b41de9c3b55c0f6c40990f45ab2be4a542807e0d1dab2ad76ed9e059f2546742fbcf7c7fbb2f9cdd1cebd74309bbd7f264ff65a8bb45ff64dd00dfd1061
MD5 SHA1 SHA512

Submit Download

cqRnt.json

Path /data/user/0/com.engage.balance/app_DynamicOptDex/cqRnt.json
Size 118KB
SHA256 43102338da114ef1801426eb439bcfbd5319fdd28dec6672537753ac2db5b30e
MD5 7a2061c494a7c63a9bf4d73d547f9c96
SHA1 c7108e09052f79d4b9541a0f8339328dd66d52cb
SHA512 7c0a456b1044dfab5ab4b0830fd0005990c1f2b4d6e5875286a068c4c6bf36d88f8cca9b3c825eef8f11968f4f847c11be6cbd7ce4070b9dc6b7c68d08b8fc20
SSDEEP 3072:GcA/CrtENZ/9Z9RZdfzUYj7C5stg5Vv6C1ObmDKABak:I/yt4ZTZdfzUY3CIyv6C1OSmk
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads