Analysis
-
max time kernel
2904581s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
25-12-2023 05:39
General
-
Target
08a3c95c6cb6e779c295ada6f07afa6d.apk
-
Size
3.9MB
-
MD5
08a3c95c6cb6e779c295ada6f07afa6d
-
SHA1
49e42437bded58e4ed7533144775cf43e7eaf7d9
-
SHA256
92c9819efea87088865bea931870dd66fd58bfa940c80c2bb63a9601ba8d92cf
-
SHA512
c7224f362292af44fe728381eb66cb65a60cf13a22ac853718beb049469acea17fb94f31c0c3fb632122875d3e66bfb9a370b36cd05ecf3649a4b293a5cedcc2
-
SSDEEP
98304:nK7CrwRTd7dK7wWZcbwuDKVdj1YoZVpeT8eQvwzpERz32L:nK7CrWTdZXNAdjioZVUcE83u
Malware Config
Extracted
cerberus
http://178.18.251.169
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
Processes
-
hover.modify.search1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
MD5bf8a3656e8ac2ec64bed5dc650c41e8c
SHA13c5342160cb190f09693b3334cc221058592cd6b
SHA25625ac851deb1daa7ac25145d0d77c08a14b5b75d545a14e26b2dee35e7a14f6b3
SHA512884c5a278547ae3ff08081b5038eaa31a047d756b455c866a391c523b1e170549b0412cae268ba208bad74469de83b2d652d675478af3b826a2b234d7aadcf80
-
Filesize
744KB
MD53f720223fc38331498f66397271a83aa
SHA14cab157d64b7bb58beb8f5ac1481b802aafd0329
SHA25659ae9285529ec8818bee510bdf9fc23a5b520628eedb5608a0097d13584d31b3
SHA512395426f4ccda4750032585132d1ce6cce0c1bf44766d51c6393b2f159fa287dc53a9496db426cfc74a5b2281b6c3ebb5bf352ce608bb25aa26d2cff344ca8f72