cerberus | 4c92f96a9d95836b0e6c9d0cd871f694625ef5c83ce2d6b38c8fead22ccdd405

General

Target
4c92f96a9d95836b0e6c9d0cd871f694625ef5c83ce2d6b38c8fead22ccdd405.apk
Size 3.3MB
Sample260816-3np7wazbkc
SHA256 4c92f96a9d95836b0e6c9d0cd871f694625ef5c83ce2d6b38c8fead22ccdd405
MD5 db95cef0f183283e50a32c00e43a9fe7
SHA1 bcb82aa2a4b15d2bd144a80809078aa13af6d80c
SHA512 244e27d4c3665f84048932ec770894b4a3f0a1a79b73ac4e3ba77e4c1afe3774ca39bcb8ae93bf42675e744c833eb3e84bed8f68e1aa36684b5e874ff1efc691
SSDEEP 49152:56B43DV+P49B9HAFS+VPEjuzhgRQ8FH0YCLwf253KpiI3JuoQw4VAkNcUL:WPgBKSqN6lzCc+5wxuo4AIcUL
TLSH
T102F5339AD743C969E05381B2C50730E71A7A208C67D9407F4B3A8A565CE7F2DCF2ADD8
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

- Target
  4c92f96a9d95836b0e6c9d0cd871f694625ef5c83ce2d6b38c8fead22ccdd405.apk
- Size 3.3MB
- SHA256 4c92f96a9d95836b0e6c9d0cd871f694625ef5c83ce2d6b38c8fead22ccdd405
- MD5 db95cef0f183283e50a32c00e43a9fe7
- SHA1 bcb82aa2a4b15d2bd144a80809078aa13af6d80c
- SHA512 244e27d4c3665f84048932ec770894b4a3f0a1a79b73ac4e3ba77e4c1afe3774ca39bcb8ae93bf42675e744c833eb3e84bed8f68e1aa36684b5e874ff1efc691
- SSDEEP 49152:56B43DV+P49B9HAFS+VPEjuzhgRQ8FH0YCLwf253KpiI3JuoQw4VAkNcUL:WPgBKSqN6lzCc+5wxuo4AIcUL
- TLSH
  T102F5339AD743C969E05381B2C50730E71A7A208C67D9407F4B3A8A565CE7F2DCF2ADD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery dropper evasion cerberus infostealer obfuscated persistence rat stealth trojan impact
- Family: Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Custom signature
  
  Accessibility-driven UI automation to self-grant permissions
  Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.
  evasion persistence dropper
- Custom signature
  
  Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1 behavioral2 behavioral3