cerberus | 385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3

General

Target

385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk
Size

1.7MB
MD5

c1808b481e4f1ef71045d0a7e2619f65
SHA1

d86c9881ac6e5d58f99be555cb52cf88b2ae4fee
SHA256

385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3
SHA512

62a89f9da0749852a740c62cac3ba03430a40588979dbc80ff832144a0c6cfce55eb5de0d655f7bc6a021b78b1796e0b4f62a715af91d06caf134d02bb6e47b7
SSDEEP

49152:pA+KidEeQ/WIWowWWahJnMA1uFDnoNTLbcemZWhLrL:pFdG/1WowWoA1KsNTLgemM1

Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://94.250.253.26

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5067	com.swing.often
5067	com.swing.often

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.swing.often/app_DynamicOptDex/NQ.json	5067	com.swing.often

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.swing.often
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.swing.often
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.swing.often

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.swing.often

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.swing.often
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.swing.often
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.swing.often
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.swing.often

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.swing.often

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.swing.often

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.swing.often

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.swing.often

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.swing.often

com.swing.often
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5067

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

2

T1628

Suppress Application Icon

1

T1628.001

User Evasion

1

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.swing.often/app_DynamicOptDex/NQ.json

Filesize
35KB

MD5
ec322e38c43afd6e408508b97f43aef2

SHA1
adadb7ad49531cbfd3f3531cfec875f81905b89b

SHA256
267027e868b821518ba2ffc000d424ce76e9e28b0b81e40da3d697328c02622d

SHA512
e6a5b8dc8ae9de235c0e3b3cca6af059d9c1bc1056e15510658c5679aa49f5e133e46a92bf042f2284eaceea6d800bef49d5bab505adc8b03f1e1ae6de5f570b

Download Submit
/data/data/com.swing.often/app_DynamicOptDex/NQ.json

Filesize
35KB

MD5
91e08fbc47e803f3f5bd2e0d39e8f167

SHA1
cfea44c91ea7ad6d866aa21e7412cfbd00873fa0

SHA256
8381d8eed74280e8cd5a6e6808963c17228729bc1d04353898d05e9815555d40

SHA512
b23155758dbc7df8ab5b0d1bab2439672f20da15129419bd2cd432b89d9b527b0cc03fdca6c1e04d3ac9495df4fffe7c9b8586bef311a98cbad08d1369710122

Download Submit
/data/data/com.swing.often/app_DynamicOptDex/oat/NQ.json.cur.prof

Filesize
148B

MD5
b3c3883e9b48bcc97e59ca7ef782657f

SHA1
9be29fded298ffc58f83b234e131426294934043

SHA256
2e196fef34438d9629da5b64c12027eddaed304554a70e4b4134ec96f120df2a

SHA512
9f8e68405b92a08be4c2d6877e5862fb88f6f5f57c9ce64c4e70b49db15afe907423e8c050f1a7ae981ded1f5a30ea9ceffd95021ccb120a636438881ece92f7

Download Submit
/data/user/0/com.swing.often/app_DynamicOptDex/NQ.json

Filesize
77KB

MD5
fbfec32963eec74794d898179aee8b56

SHA1
cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

SHA256
d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

SHA512
f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads