cerberus | 9c7afcaff754719f597a43b13575dfe4eb8d0af733734b19f9acff0ae772019c

General

Target

9c7afcaff754719f597a43b13575dfe4eb8d0af733734b19f9acff0ae772019c.apk
Size

1.8MB
MD5

68d1cb04aa3109a03d69a1080207428a
SHA1

f0efcac492b6d021518449070b9672b434f5c8c8
SHA256

9c7afcaff754719f597a43b13575dfe4eb8d0af733734b19f9acff0ae772019c
SHA512

9a0e118464b432b563cc354b4885f2112582e161a82f0d11094fe4809dc324868f8264e84749015f95545568a901fd098090f2a0078ccfcd48f7abbb661cc0c1
SSDEEP

49152://XLnnbGbJI7zM9fGFAJap7kGKBNRuFnp4pvLbOemBWhLJi://Q+sGFAYp7kBRKWpvLiemEy

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://94.250.253.26

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4266	com.clarify.aim
4266	com.clarify.aim

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json	4292	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.clarify.aim/app_DynamicOptDex/oat/x86/FgoFXgf.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json	4266	com.clarify.aim

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.clarify.aim
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.clarify.aim
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.clarify.aim

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clarify.aim
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clarify.aim
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clarify.aim
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clarify.aim

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.clarify.aim

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.clarify.aim

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.clarify.aim

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.clarify.aim

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.clarify.aim

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.clarify.aim

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.clarify.aim

com.clarify.aim
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4266
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.clarify.aim/app_DynamicOptDex/oat/x86/FgoFXgf.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4292

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Protected User Data

1

T1636

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json

Filesize
35KB

MD5
dd6d1413bb86b7f93b4a652becc9810c

SHA1
74c7981d5439a77077e6c4029fc9db6e48ad0c1b

SHA256
c1a4499285b7ab62233bb727fcbf2d2ed95497bf72a95a28628108cd7ec133d5

SHA512
e39cdfc5656567a136d73dcf476f309b263fc6e863afd0fc98e6a5c74a58ed63eb60e897373e4275a5d6d402f1bca0d3c017f8eb866d480b280382cc44dd7257

Download Submit
/data/data/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json

Filesize
35KB

MD5
e2ecc7206be385fe5a895df5a4354013

SHA1
9a7554de566ec08282fce8a5a99759cd0b31d809

SHA256
93b334d6fb09146ce9b51f719fdfdfc27d5f787fb171822f7b01f0f4bb509ccc

SHA512
822e979a7b984173390445e435f0b71ed6974e1b060afb62245da860663dbb53f2c0e4ce92c402527956199cc2e2bbf10be7a92b070ca6938459ee23c52e9b04

Download Submit
/data/data/com.clarify.aim/app_DynamicOptDex/oat/FgoFXgf.json.cur.prof

Filesize
228B

MD5
fe81deb002e338e9ff58a63251c3ea0a

SHA1
e6e45cec96f142b3edcd9c7770bc70b70063ae12

SHA256
c2af921b192a222af2cf760378d030e105b2923526cb8031cd255d023bcbc229

SHA512
117309bcc86fb23c548efc47b341700ea96988861997c55e6ae01f9e0cc854f0a824bea7677b01529df14aa8b8a74899a09fe033f758d935a1168060f6c62b70

Download Submit
/data/user/0/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json

Filesize
77KB

MD5
9dfa580aa93694ae97b83ecb5cfa9ff5

SHA1
b17c51cbd1dad8b069e2ac3adab7fccfd6bd624f

SHA256
caaa953fc8d5eb5d2cbac6e280ed76c7e3ddaa2f0f4eb2ed5e7d58b7b7015ddf

SHA512
22c51103d9bdf7997ccb6557c92613f431b9c643a1825d4264fd4767a0f1f8e66b8f2719ccbcda1bf5aae2c9448729212e722b6d9091a4f1c7eb6cb6bdb034fb

Download Submit
/data/user/0/com.clarify.aim/app_DynamicOptDex/FgoFXgf.json

Filesize
77KB

MD5
fbfec32963eec74794d898179aee8b56

SHA1
cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

SHA256
d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

SHA512
f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads