Analysis
-
max time kernel
2790642s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
24/12/2023, 06:30
General
-
Target
e7bf50674fca53b416a5ec50dc86d07f080e3429ad84ea956c758cf7beec06ef.apk
-
Size
3.4MB
-
MD5
c51085d2f81eb3ba8d4a7b8786167899
-
SHA1
17c3bffcb7793110f2606ed34642801e6a01d5ab
-
SHA256
e7bf50674fca53b416a5ec50dc86d07f080e3429ad84ea956c758cf7beec06ef
-
SHA512
fe37a6ed9b053421371042749607e2a60b51ed9ae86ae8000ae47e74320361cceeec1ccf3ab1bf374764309454b85abde1ac1ab05cf76b7d16faec873f7e8594
-
SSDEEP
98304:WT7mOSF3Ze3sPMkHdX1bjrcIApterESpmmTDch/1yGWG:VOSF3ZSEzfIpterESEmTDchdJWG
Malware Config
Extracted
cerberus
http://213.136.90.194
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
Processes
-
wear.mountain.bacon1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
233B
MD550367ca6a28286015688b7bd77f1b7ba
SHA1836db7af1d8dd18d123e5f707b51da2909c3d1e8
SHA2564d1e83419a50bc522699d4ff50f71e4eff4c46647a97876dfae36e32a52ed4bf
SHA51221e697045d54b854c6776ada3301ed97e959edcd7aebbd62c88c9b0a5d885bba495cb5795ae5cc40cb9046a59b3a5b449fbf20ef30b4eaab8d89a419e83f90c5
-
Filesize
686KB
MD580acf3d54339041438635fa4893eda53
SHA15353ff0ef51575ef2ab158567825191a0cec8750
SHA256f9ece08d1e396c3838ef88c87bf29db16b19a89b1284afa913c3ea7e6856921f
SHA51294f80cb3e718c2e6d101ee9b2cf580b3044fc4ae307b6bd1280c34d06ffa8ac0dae71aeacf52f723e9296b1200b0e2e247e266478de0e24ffb360d7d51df073b
-
Filesize
686KB
MD5c429450bed7dd02b527c10527ccdd869
SHA1c6c73df38d4dcaa64806da68bf980a16111d2975
SHA256b90e70a408da5bb199d410956f223b38671744c6e2c01478375b424eb2db68ff
SHA5127e020fc5589c94bdf964d16706200d6d51d6fec04d0e25c60f1a07c033227125eb84a356cc540121c27fe9daa090b1d31d06621cccb41fe0c6c039c469ee295f