cerberus | 6ef5e43779891bd57e08663c1f3085faa4c00546f86b65c02a95c56b65cb7b05

Analysis

max time kernel
61s
max time network
143s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
02/02/2025, 22:02 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ef5e43779891bd57e08663c1f3085faa4c00546f86b65c02a95c56b65cb7b05.apk
Size

1.6MB
MD5

53f73916a84c20994d3bc3655e9e8c2c
SHA1

f8e847095302db2fd64084ae379bfe94c8680953
SHA256

6ef5e43779891bd57e08663c1f3085faa4c00546f86b65c02a95c56b65cb7b05
SHA512

7567962262fd28c7d2267a3afd99217eedf484d485b6494b440fb08af56002c4f7c99bf360095902fcc9d89dee6e64de0683857671d2644a6d083702519e3075
SSDEEP

24576:6p+ERCdw5FUMnFx3F9Lfj8dmyDy8JVxvfMmA8mPeIuwdm99FdOcaOMtM62Hs+p3u:6JYdrDyWDvfo8mGP/9FYyTs+9LLxNy

Score

10^/10

cerberus banker collection credential_access defense_evasion discovery evasion impact infostealer privilege_escalation rat stealth trojan

Malware Config

Extracted

Family

cerberus

http://83.136.233.183/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus
Cerberus family
cerberus

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4459	com.lady.naive
4459	com.lady.naive

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.lady.naive/app_DynamicOptDex/YYWAcjA.json	4459	com.lady.naive
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.lady.naive/app_DynamicOptDex/YYWAcjA.json]	4459	com.lady.naive
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.lady.naive/app_DynamicOptDex/YYWAcjA.json]	4459	com.lady.naive

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lady.naive
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lady.naive
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lady.naive

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.lady.naive

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lady.naive
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lady.naive
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lady.naive
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lady.naive

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.lady.naive

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lady.naive

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.lady.naive

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.lady.naive

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.lady.naive

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.lady.naive

com.lady.naive
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4459

Network

DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

142.250.187.206
DNS

ssl.google-analytics.com

Remote address:

1.1.1.1:53

Request

ssl.google-analytics.com

IN A

Response

ssl.google-analytics.com

IN A

216.58.201.104

172.217.16.238:443

tls, https

1.5kB
40 B
1
1
142.250.187.206:443

android.apis.google.com

tls

5.6kB
9.0kB
23
23
142.250.187.206:443

android.apis.google.com

tls

1.8kB
6.0kB
10
10
216.58.201.104:443

ssl.google-analytics.com

tls

1.3kB
6.3kB
9
9
83.136.233.183:80

300 B
5
142.250.187.196:443

tls, https

848 B
40 B
2
1
142.250.187.196:443

www.google.com

tls

11.1kB
11.5kB
30
38
83.136.233.183:80

420 B
7

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

142.250.187.206
1.1.1.1:53

ssl.google-analytics.com

dns

70 B
86 B
1
1

DNS Request

ssl.google-analytics.com

DNS Response

216.58.201.104

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lady.naive/app_DynamicOptDex/YYWAcjA.json

Filesize
64KB

MD5
54cb2b3465aac4e820716e66fe7dca47

SHA1
f1cd36a489f6180b05ef626d9b746d340ddfaa16

SHA256
48b6911e007e1190b896b254dd1af26f0b1b2b983885c13c8bdbbd3f68411365

SHA512
cf33ee0a36957b5eaf4bdbbb2f52d746b648f3974681551e897a445d407d1c4dd62fdc7b33e4f879805b8859781644566f0f8e1eacf4bbfdf366e09646bc9706

Download Submit
/data/user/0/com.lady.naive/app_DynamicOptDex/YYWAcjA.json

Filesize
64KB

MD5
4b9ceae4b200e6f6e7f1f4a6a55ac826

SHA1
55ab1e29105c118d60a564642ff3ee15475c00b3

SHA256
03bb3765f38b2763cf6309b5dc3f9064de0c48f59bf7d6a188b7ddb4ae809e89

SHA512
8ac911dd618eb7dec863c4ec5268b6321763a0b1ff4d2053906650ef365d6db9a4c919895c149675fc7f089f465d4069f05432e8f9c4cb37e2b44fe28d4fed0c

Download Submit
/data/user/0/com.lady.naive/app_DynamicOptDex/YYWAcjA.json

Filesize
118KB

MD5
319edfc7800cd95f601e378877da93dd

SHA1
48dfc57aab013d0edafe34829dbe91ff7eac0fc6

SHA256
633eef55f1182663b9f0cefe056fc85a9fd1c5a4a146201a17677074c10afb85

SHA512
7b9de6b544731c3134e40503c73d261c65f0234ae511ba46e3829fa4d836b2d1f993e1082340ba1dcd89c4f1a8d3dd5a5bf83eaf9bf5ad004c0758d80cf7d1f9

Download Submit
/data/user/0/com.lady.naive/app_DynamicOptDex/oat/YYWAcjA.json.cur.prof

Filesize
151B

MD5
9b6a5b1835b3cd95d8d28ff6632b5c2a

SHA1
5044f6729e3a2a7335b0ea2c57cb01f4f37b72b9

SHA256
9309d06f78cb284dc6094204e04fbd14eb2f257da0a485334adab53fe5c93f2c

SHA512
41768fd9e31fa5763345d2b12b9d0e2f5bcaf265c0d806f880a84d7821879d544adfaa5df3d36241277e2436f392443d4d243f51d4306af81b0f029a940f9a50

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.