cerberus | f6dc913225e2d474af7351e72c3a25d1f0a19c58e4ff232f8b343c0ed3f8fccb

General

Target

f6dc913225e2d474af7351e72c3a25d1f0a19c58e4ff232f8b343c0ed3f8fccb.apk
Size

2.0MB
MD5

9e0ad00aeebfcc57107425a0e2a9035c
SHA1

e5381f47c4e771ec9bb5d2d9e6abba6919f9cb6f
SHA256

f6dc913225e2d474af7351e72c3a25d1f0a19c58e4ff232f8b343c0ed3f8fccb
SHA512

0278f942031fbed96ecc3bfe71dd67b03823508f80ea2dca18177b584e09f00b69f34196cf40a1e6f4a7ad1e5c8d99ca0a13ca087d3741a289d60597ef04e2be
SSDEEP

49152:2Hf+3NR1RLA0dmgYqbp3HhjEcQ/nzHpXfMNgQJ0WYCqZoIpD8d9XVqecD3WlP:2/kRb9dmg51HhjEcQ/zHpXfMNgQJ0NCd

Score

10^/10

cerberus banker collection credential_access discovery evasion infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://5.78.71.159

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4318	com.foster.grief

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.foster.grief/app_DynamicOptDex/FTJZ.json	4318	com.foster.grief

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.foster.grief
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.foster.grief

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.foster.grief
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.foster.grief
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.foster.grief
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.foster.grief

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.foster.grief

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.foster.grief

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.foster.grief

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.foster.grief

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.foster.grief

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.foster.grief

com.foster.grief
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4318

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.foster.grief/app_DynamicOptDex/FTJZ.json

Filesize
54KB

MD5
a9b945418a5ca87d1afc41c4b1a69173

SHA1
9a5b6c904ad4bd6c8f3575e1143989af759bf84f

SHA256
2f4d4c0d219c339f0ced2b3cadad3ea5e0660fd768a03e1eec5c378690595593

SHA512
4e3ebea2264c3c2448cb96931575e0202213e35f4e589f951ac2b06f90f0196b5958ec06a3402c2099ccee55964d38357682130b51353d0e4d10548c5794e292

Download Submit
/data/data/com.foster.grief/app_DynamicOptDex/FTJZ.json

Filesize
54KB

MD5
37bb4840349f61aadb719dcd37d80f36

SHA1
beba50a58157dace010b36b2670e23ed2eed8363

SHA256
6f7ae0980724939f70cd370d72bb519f284e9dc0a99cf84a724f320580d47281

SHA512
a75c7cfc67d26a27efc88ceddafef487ea1c40a742c1c0efc046f7efc735826fcb738178de46f088d9464537ca94a796516746620e47ce2ba5aa1648b19c039e

Download Submit
/data/data/com.foster.grief/app_DynamicOptDex/oat/FTJZ.json.cur.prof

Filesize
180B

MD5
ce2915fa41603311d5f13a6207a9812c

SHA1
faabdfaeea1f00c550a805a1fd421fc9ebc0fbb1

SHA256
9cfe184e5eebb03fc77d586396cb9d3da325fb2acbed157382b9436cb530dab2

SHA512
8593cb7fac24aedee10babbe63cf5ea26406af984c350edd214b7c610350dd2c69624d54bd178889819d8aa4117684df310f598f70e28ed037cf117045925682

Download Submit
/data/user/0/com.foster.grief/app_DynamicOptDex/FTJZ.json

Filesize
103KB

MD5
49066cdefd54aeb385ffe98aac837787

SHA1
03e3e6e2049c4c3f3416e552f859fc8e6dd08ade

SHA256
066f88a10f433fec31050908bec2d9a1d5810240238e1e8a3571969e7c495e97

SHA512
86a2a7d17a61bac794348dca5ce7734c499cbf81a4918b1f9af619e196070e84c34929e17ef6fc575ebe2ae2327e0d461f7e0c1baf2303f79a70f62a4dcd6853

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads