Overview

overview

10

Static

static

6

19da129abc...d1.apk

android-9-x86

10

19da129abc...d1.apk

android-10-x64

10

19da129abc...d1.apk

android-11-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    157s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    12/03/2025, 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19da129abc4e543eddf0eda4795960eac926ede4b07bdb72f4afe43437f536d1.apk

  • Size

    1.7MB

  • MD5

    677da7888f04a3cb95e31602ce2573b3

  • SHA1

    dfaedbdc9a6a437a3c40ccee9af15c87194d7067

  • SHA256

    19da129abc4e543eddf0eda4795960eac926ede4b07bdb72f4afe43437f536d1

  • SHA512

    a4a93751a5965c42fee4b5a4651fb852a8d5b636f4f173c1eca32168222be8340d66011c0bdb563deec8b120cf69319a549f3c9901c9305d61565fcc1916c532

  • SSDEEP

    49152:iUaQwNVUaFLjZXlijxscjgVunVrgyk/9ygYmhFuONYIc2biMQu:iUa9NVUaFLjglgExgx9/1hFuONU2biMz

Score
10/10
cerberusbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://162.55.21.189

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.share.seed
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4219
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4244

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    e55668923d7c9aec5e9e52268f37b14d

    SHA1

    0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

    SHA256

    b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

    SHA512

    ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    decebb743a92fe0a0acfdeca968c5d6c

    SHA1

    d32c12030a200b5caf85a07c09dc063ad5431d44

    SHA256

    a92ea079b1602ca7a43ca2048e16475c2832a1b9b98c9602d30779aff6fb3981

    SHA512

    434557959be34d19c1c0b28a74d55c75aa44e97bab79fb55c03f66d29ae1856e78395976c27af6f3c1f4bf972753ab950339877ab7bb9c59cbfef4d77f2ad261

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof
    Filesize

    813B

    MD5

    e86c48ea9e294b41365f61dca42c7db8

    SHA1

    49d2b5d6cf1d6c491fd62a8dc62ba61886166a66

    SHA256

    ba7e33f8df7fb195f44a91f742497d9562c979a65fbc48206f78440628432ae8

    SHA512

    52c3e7b4a18a468f3aa879189c7c47c676d5ce3f022f864f45463d45712ca616de9546263e746476d88dbba26c7212ae9f5b881b5abb31f92699978f0e8c27ab

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    02d0a7ebb9a9e83f1ff75fcd631bea91

    SHA1

    4227f46b3c07a93b585a19fa1b5294ea616abcd6

    SHA256

    086694c946a8b7407e34734d221148f1c52fe9d0e5a0d680c707a586427c4852

    SHA512

    3554ba5cdee20b4a252d43ec45540a177c7f5bfdf0febc0c2abe1d48450a0284fe2108a0392765f524840572824a15642fd6c5aeef3221ec16938835651047f5

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    bf3a8b20950af2241e402aa6c819bcbf

    SHA1

    fbe7196d34d9fff857087a88a95df291b02e52c1

    SHA256

    307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

    SHA512

    68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

    Download Submit