cerberus | 501eb3e8474ddd35728b11248df2e9629afb6852b9281940059fcae7b9043522

General

Target

501eb3e8474ddd35728b11248df2e9629afb6852b9281940059fcae7b9043522.apk
Size

1.2MB
MD5

ee3dac4971a8e69c1fda0c5e82c5a25b
SHA1

7156303c8a2345113510b6da56913625b30b49b4
SHA256

501eb3e8474ddd35728b11248df2e9629afb6852b9281940059fcae7b9043522
SHA512

3c160bf57786acc1bf83dd040a20a299f4614c2fdc860728357d4c05bc9a54f4e56ff459b5201389f8926986db196a8da4bfea159c863cd2b55e9fbfe8521f06
SSDEEP

24576:PolR/rDxk0t/aTAD+xpx/IgMI/qqOd86V9Q8gfmYOfPbEpMpXFEgzMIGcoR8:Por/rDxkIAADEr9MMwVjge3QSpXCgzMi

Score

10^/10

cerberus banker collection credential_access discovery evasion infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://135.181.83.2

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.wood.area

pid process

4253 com.wood.area

pid	process
4253	com.wood.area

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.wood.area/app_DynamicOptDex/oat/x86/rtbE.odex --compiler-filter=quicken --class-loader-context=&com.wood.area

ioc	pid	process
/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json	4279	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.wood.area/app_DynamicOptDex/oat/x86/rtbE.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json	4253	com.wood.area

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.wood.area

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wood.area
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.wood.area

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.wood.area

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wood.area
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wood.area
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wood.area
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.wood.area

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.wood.area

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.wood.area
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.wood.area

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.wood.area
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.wood.area

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.wood.area
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.wood.area

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.wood.area
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.wood.area

description ioc process

File opened for read /proc/cpuinfo com.wood.area
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.wood.area

description ioc process

File opened for read /proc/meminfo com.wood.area

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wood.area

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.wood.area

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.wood.area

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.wood.area

description	ioc	process
File opened for read	/proc/cpuinfo	com.wood.area

description	ioc	process
File opened for read	/proc/meminfo	com.wood.area

com.wood.area
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4253
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.wood.area/app_DynamicOptDex/oat/x86/rtbE.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4279

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wood.area/app_DynamicOptDex/oat/rtbE.json.cur.prof

Filesize
818B

MD5
0e2d59cc7f7c6b5fdd56f3735f0c019c

SHA1
dd35f7f3d5b1f6583d4611afbb86cb3678cb76bd

SHA256
c5f9ce098d4c1e4264adc0a55e7ef75ab8268d59fbf22b32c960eaf113bd2949

SHA512
7135d63340b779196b4ce82618a6b4957f1e227589030c493c7ce4aed01928641869e13742ac240f609a3bd4321524abe239880ef075f2724df7505599572e46

Download Submit
/data/data/com.wood.area/app_DynamicOptDex/rtbE.json

Filesize
54KB

MD5
3e6f36c1bd8a886a4ca933475cc30871

SHA1
ccf4384ca9047e488bfab9489e1d10da0fe5b483

SHA256
8f21ba10c1a1fd641f3f2dafc78fd7cf097f1b2d51e7a05cfbecf5d0be57df9d

SHA512
286912b5dcb22702024a9a6990eb430d4600e20aa04ad7444b3865f79786ccc13e84620de29848a9f60f247ca9bf8870cc01aaac509c4ec87dd6d2c943c3c04b

Download Submit
/data/data/com.wood.area/app_DynamicOptDex/rtbE.json

Filesize
54KB

MD5
900c122df25b70e0807fcfa12576d3ee

SHA1
d333a5a7f3a0f505c3bc3e30223312c92be1e4fd

SHA256
a8b5627b680cfcba36cbaff64d06fcd316d1077d107a5a605c5a21e989243d56

SHA512
51e2de52cf0bf36cf4963b1ecea29de6ce9af51b5e74cedc00748e19e03f1aa1b5465b841817ad46bf0298a2fccfbc30ab6e18bda78bb9ddc774ba3c6a431ecf

Download Submit
/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json

Filesize
103KB

MD5
b8d8c7fe7a43ca2abb685f42683beced

SHA1
1f35f94cd950ab3d06e7ecef37b160c4d66a9058

SHA256
79385fd9a20732b92d2c3ac682950aa29143d81f3c468a12b13f8f9d433e957c

SHA512
96cff8ed1c42e5d59a0bb6f2b611858700aef5591484057d75a2addff29d4b9631eb233809d3d81d0b82a94b1cca0240cf4499d3d4403eaead8abf2e59fd7532

Download Submit
/data/user/0/com.wood.area/app_DynamicOptDex/rtbE.json

Filesize
103KB

MD5
4567037ecc388035c32688052a6867f0

SHA1
3b2e73e1d976c9f23f5284ec047ee37e46fe5a7c

SHA256
8e5dd44bcaaf36ba5b3378662a9da023410b4f4990ba3089925d634915dcc7b0

SHA512
d703b9ad5a700bad9e41a4f956a956b3881a4dc607d7292264ec20f78bdc068b7acb66f3a5002bf9cab6b421d166cc68476a476f49057d921a14730a4bf16153

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads