cerberus

Sharing

General

Target

da0f4ff5b71b73329e9124a28a859a3afe4303e833cf604f01de0503586206be.bin
Size

1.5MB
Sample

240629-123c9a1dkj
MD5

55cf505591582150d44eb3b6f1438b34
SHA1

13120e522d0e13595178d53aaf9a527c2ecdb8c6
SHA256

da0f4ff5b71b73329e9124a28a859a3afe4303e833cf604f01de0503586206be
SHA512

a648b000e2b941d5436af1dccacd05fff0105d1e1b30cf12c4ec04f384ff2e9f3bcbc4b16582ae5c84c3125473612a0b8ae312485dd005b378ddb7c8e8b0bcc7
SSDEEP

24576:BRJ2LzEYRixM6fePPbeCxFVyok3pMMZdrQO1MScE/01Cj5lvHhoU2Qn0gwliGw:w/6eLIbZtxSCs1C1lv6U2q0gwl3w

Score

10^/10

Malware Config

Extracted

Family

cerberus

Attributes

uri
/villaburada.php?action=botcheck&data=
/villaburada.php?action=checkAP&data=
/villaburada.php?action=getModule&data=
/villaburada.php?action=getinj&data=
/villaburada.php?action=injcheck&data=
/villaburada.php?action=registration&data=
/villaburada.php?action=sendInjectLogs&data=
/villaburada.php?action=sendKeylogger&data=
/villaburada.php?action=sendSmsLogs&data=
/villaburada.php?action=timeInject&data=

Extracted

Family

cerberus

.urlConnectPanel.

Targets

- Target
  
  da0f4ff5b71b73329e9124a28a859a3afe4303e833cf604f01de0503586206be.bin
- Size
  
  1.5MB
- MD5
  
  55cf505591582150d44eb3b6f1438b34
- SHA1
  
  13120e522d0e13595178d53aaf9a527c2ecdb8c6
- SHA256
  
  da0f4ff5b71b73329e9124a28a859a3afe4303e833cf604f01de0503586206be
- SHA512
  
  a648b000e2b941d5436af1dccacd05fff0105d1e1b30cf12c4ec04f384ff2e9f3bcbc4b16582ae5c84c3125473612a0b8ae312485dd005b378ddb7c8e8b0bcc7
- SSDEEP
  
  24576:BRJ2LzEYRixM6fePPbeCxFVyok3pMMZdrQO1MScE/01Cj5lvHhoU2Qn0gwliGw:w/6eLIbZtxSCs1C1lv6U2q0gwl3w
Score

10^/10

cerberus banker collection credential_access discovery evasion impact infostealer persistence privilege_escalation rat stealth trojan
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Tries to add a device administrator.
  privilege_escalation impact
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Queries the phone number (MSISDN for GSM devices)

Performs UI accessibility actions on behalf of the user

Queries the mobile country code (MCC)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Tries to add a device administrator.

Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3