cerberus | c4648a8011f5d3e18feeb69c079e6af6e8c51321a9e7b5493bbf50e6fbfc1bfe

General

Target
c4648a8011f5d3e18feeb69c079e6af6e8c51321a9e7b5493bbf50e6fbfc1bfe.apk
Size 3.3MB
Sample260818-yhkb8a1sav
SHA256 c4648a8011f5d3e18feeb69c079e6af6e8c51321a9e7b5493bbf50e6fbfc1bfe
MD5 2c31fdb2c51684b9e44c3f4851d91eac
SHA1 e3641b6f79cf1af7d1c15b65a5ade7499023182e
SHA512 acbefdd427306a580423ebe32b7e36e5f246fa81aa514ce76232a624f09f925e703a4d3077269d3c531ce543060e4cf25572fdac2f22a4385f72b80f3a9c6bd0
SSDEEP 49152:9HTiFYHt9ISHgXNlkRWG3f6HWeMxlkE0M5+If7FpJF2W8RH85VV4CHzpg8m7Kob0:AqHPINlkoVH9cZ0M8iLF2FSSCHFM/0Dl
TLSH
T1BFF5332B7A13890ADB0B007781476EBABD85929C65D1B31F1C7A44568FF1FCC5B27CA2
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

- Target
  c4648a8011f5d3e18feeb69c079e6af6e8c51321a9e7b5493bbf50e6fbfc1bfe.apk
- Size 3.3MB
- SHA256 c4648a8011f5d3e18feeb69c079e6af6e8c51321a9e7b5493bbf50e6fbfc1bfe
- MD5 2c31fdb2c51684b9e44c3f4851d91eac
- SHA1 e3641b6f79cf1af7d1c15b65a5ade7499023182e
- SHA512 acbefdd427306a580423ebe32b7e36e5f246fa81aa514ce76232a624f09f925e703a4d3077269d3c531ce543060e4cf25572fdac2f22a4385f72b80f3a9c6bd0
- SSDEEP 49152:9HTiFYHt9ISHgXNlkRWG3f6HWeMxlkE0M5+If7FpJF2W8RH85VV4CHzpg8m7Kob0:AqHPINlkoVH9cZ0M8iLF2FSSCHFM/0Dl
- TLSH
  T1BFF5332B7A13890ADB0B007781476EBABD85929C65D1B31F1C7A44568FF1FCC5B27CA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery dropper evasion cerberus infostealer obfuscated persistence rat stealth trojan impact
- Family: Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Accessibility-driven UI automation to self-grant permissions
  Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.
  evasion persistence dropper
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1 behavioral2 behavioral3