cerberus | 5c4bee482b5f97962a4e9047ddc4c9e9473bd7afa1b44cb666ef9998f4c7c29f

General

Target

5c4bee482b5f97962a4e9047ddc4c9e9473bd7afa1b44cb666ef9998f4c7c29f.apk
Size

1.3MB
MD5

47666bd615309f5d8e5bd72a5e2ebcea
SHA1

b57cf1c42a1087910025219899c8133457b3ed98
SHA256

5c4bee482b5f97962a4e9047ddc4c9e9473bd7afa1b44cb666ef9998f4c7c29f
SHA512

7bd918897a4a91e69144dafa6ccf0ccb95b6159b8d3393bf090a3e0ccac028759c035bf4298794760fbb63628169ee1589bfd6712c2923cbc472c34774402003
SSDEEP

24576:qPyqpSCdUtJ15nDNwdqutWxfIZtDxVje/FfSZgJnc7HLlt40ZKemusWhWmgZU:vIRdgD+djXVVjuFfdc7HLlqXemrWhLgO

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence privilege_escalation rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://80.87.192.227

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4256	com.maze.say

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.maze.say/app_DynamicOptDex/akSQipX.json	4283	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maze.say/app_DynamicOptDex/akSQipX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.maze.say/app_DynamicOptDex/oat/x86/akSQipX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.maze.say/app_DynamicOptDex/akSQipX.json	4256	com.maze.say

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.maze.say
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.maze.say
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.maze.say

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.maze.say
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.maze.say
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.maze.say
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.maze.say

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.maze.say

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.maze.say

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.maze.say

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.maze.say

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.maze.say

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.maze.say

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.maze.say

com.maze.say
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4256
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.maze.say/app_DynamicOptDex/akSQipX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.maze.say/app_DynamicOptDex/oat/x86/akSQipX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1626

Device Administrator Permissions

1

T1626.001

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

3

T1628

Suppress Application Icon

1

T1628.001

User Evasion

2

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Account Access Removal

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.maze.say/app_DynamicOptDex/akSQipX.json

Filesize
34KB

MD5
0ff91958110f2e838e90f95cc1660a05

SHA1
9a17da9ede6d847f318fae59ede3215b0ed71e2f

SHA256
69a1742156149aaecb1f455e4b7e2293e92a2fd32b9dded8d5e34fd888e1257b

SHA512
6a886e07b8d009cddadb01677d80a3b862fdf35166dbee9ed7b774793cec35ecb93110ede37575891d6c7c16b0f9daa2ace069222b21ee171884cd460380506c

Download Submit
/data/data/com.maze.say/app_DynamicOptDex/akSQipX.json

Filesize
34KB

MD5
fb50556b1bf69c8c33abb50c05d6af1d

SHA1
f7827bd88e3728c51b8b3baa324d449035e62c8b

SHA256
b2c0b21d464d299e9ebbfae0fd41e8f63749d66aaad37fe021a2329634d769ec

SHA512
49b3a022e6b73c942e4a366faa653ce11fb4a5e0c3b3551861f7b0f0aab2f7f801bba2845b5178c92ca76222991bf3da9edf974713d4f484fb5c6157cc777a14

Download Submit
/data/data/com.maze.say/app_DynamicOptDex/oat/akSQipX.json.cur.prof

Filesize
255B

MD5
7047a234aea5ef7e1940f123244e6048

SHA1
e6e9dd75b09d3eb07232350ffe109db8de6c43d1

SHA256
3ebb4081ecd9d727e0dd31182868ca3109108fc6c6343d88be3f312a2d0b2180

SHA512
5d73edd3d6f32a3c8572a3d94771f5b13d21e00f655855c60e2d72c13536e338fceab721787ca6f60934c6de88c7c52a8b24df40927a53280491df0e3a7dc6e8

Download Submit
/data/user/0/com.maze.say/app_DynamicOptDex/akSQipX.json

Filesize
76KB

MD5
f65b9c2cccfe676d73f557a3f2d4cefb

SHA1
ba8ca12aded8667b7771af6230bce74b2d104cc3

SHA256
290fc2c6a696befeabb47b3b84cd2c00cf9a1ec520549f2ec33c688bc254b3af

SHA512
a5b0f6f604c11b84ca2add11cdd5c51bdf0fdf2d8208de26384440136e3760053afd394e7e1e0aeb177f7b09fb9b64fa4020a021f2f82020a8d9b409d3b319ab

Download Submit
/data/user/0/com.maze.say/app_DynamicOptDex/akSQipX.json

Filesize
76KB

MD5
262d9655c7d686d31b55aa1976061517

SHA1
5f6d350e5e6ae66afee5ddddf4aceaf5dcb8899c

SHA256
df1baa0be867f09df28532c5078b0c84f1f133e5b33182143f776ae3751779b0

SHA512
b660b7636b06b2aff6e4da60346424ba6902a3e247760e211f628b0ad582d36eff04acbba3e600442a0da57449316f458643f49ff34ce82f2cc8dfbe2e8aa16b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads