cerberus | 991fbf32c2c1714156b9a7f45188a41ad57ba58546788a96a80ebc7acee17331

General

Target

991fbf32c2c1714156b9a7f45188a41ad57ba58546788a96a80ebc7acee17331.apk
Size

1.5MB
MD5

b002261973818d3e103ff930a33892b7
SHA1

d64b695d32362ac870b5769b64b5f4ceb51e1baa
SHA256

991fbf32c2c1714156b9a7f45188a41ad57ba58546788a96a80ebc7acee17331
SHA512

b066f93cb94fe9aeca8e5d4715915d064121b4f2e89fa93b7f9743ccff416bbd49993ff074dd638b448d9d715a1eab337d41d70a40a81d3fab2877219203cc23
SSDEEP

49152:zbIuBmFHNaGr99ruFrWkH/LFiemnWhLHu:zbI6AtaG3rKfH/LsemWg

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://94.250.253.26

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

Processes:

com.return.hello

pid	Process
4760	com.return.hello
4760	com.return.hello

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.return.hello

ioc	pid	Process
/data/user/0/com.return.hello/app_DynamicOptDex/MWM.json	4760	com.return.hello
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.return.hello/app_DynamicOptDex/MWM.json]	4760	com.return.hello
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.return.hello/app_DynamicOptDex/MWM.json]	4760	com.return.hello

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.return.hello

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.return.hello
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.return.hello
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.return.hello

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

com.return.hello

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.return.hello

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.return.hello

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.return.hello
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.return.hello
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.return.hello
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.return.hello

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

Processes:

com.return.hello

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.return.hello

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

Processes:

com.return.hello

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.return.hello

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

Processes:

com.return.hello

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.return.hello

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.return.hello

description	ioc	Process
File opened for read	/proc/cpuinfo	com.return.hello

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.return.hello

description	ioc	Process
File opened for read	/proc/meminfo	com.return.hello

com.return.hello
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4760

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Protected User Data

1

T1636

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.return.hello/app_DynamicOptDex/MWM.json

Filesize
35KB

MD5
16dae30178e6f71e40979519982dbf77

SHA1
b72264b10e4778b36876f53ac2c3f9bcaa8c9805

SHA256
ce28b23fc77f674a0ad21cc5e501f9a10ae60642f70a8fce52e3d40f788cdf22

SHA512
c517c052920453225cfd7e6b442c7f74cc8028ab41bab39a3c5aaa97f8040d86e286f50e46b60b912236e6c1b27a880042e6b45c0d16b0631b8a6fa4f6a98cb8

Download Submit
/data/user/0/com.return.hello/app_DynamicOptDex/MWM.json

Filesize
35KB

MD5
60d4add23b23ee17a47269f85ada7dca

SHA1
ab6a7852255261782d19c406e369671b888bf2c4

SHA256
fa75eae1e3e6b8140ac9241e80edada9ee14f00a02a8a093e0cf51a5fef0eee6

SHA512
f03e45720d67afdf625c9da38dc87f72d9a23488ff51407d1ec813d8227512ccfac75041bbdc390f0601b78b29a4e490e5aedde625f42f69fecae23dae608e35

Download Submit
/data/user/0/com.return.hello/app_DynamicOptDex/MWM.json

Filesize
77KB

MD5
fbfec32963eec74794d898179aee8b56

SHA1
cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

SHA256
d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

SHA512
f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

Download Submit
/data/user/0/com.return.hello/app_DynamicOptDex/oat/MWM.json.cur.prof

Filesize
146B

MD5
de92073bcad2e9610765022c7fd8c2d9

SHA1
8df17aa8778e7d8a0da0cad45825fc11472f31ef

SHA256
9fa707e4f8fd61a4d4c0c1306b4f9fd20e8bcbf387a03ac9dd2ade9ea4c2ab52

SHA512
011244957984fe75869c35fef5b0e2789c5eb224cf5712a96607fbf4895fcccc8c9655b0895b95aa534ade466c2108af74132fffdf2a0153bc4d5b068ba6d930

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads