Analysis

  • max time kernel
    3592201s
  • max time network
    141s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    04/01/2024, 20:10 UTC

General

  • Target

    41c566fc2455a8ee2c37a887ec2e4f9b.apk

  • Size

    136KB

  • MD5

    41c566fc2455a8ee2c37a887ec2e4f9b

  • SHA1

    bc696293077a7c88d6833e1facb63b802eb2b235

  • SHA256

    64e3f01f37b2d1e8f609660fc638736e51681ba7e482d6286ad15ccb772dd3be

  • SHA512

    8e12ee0e326dae3d9a67aebacf560350fedfe342213832dc0fbc0c4355864d2ff85cf695d94cda006c2bb8a6cdea169e1c472368e584efdf81a7afa68bc2b963

  • SSDEEP

    3072:mzSsiJBx9K3og6cpV3q4qjJOuJON8J8GwA4zkwA4zQUlvDm86UlvDm8Z:m27z9KYdIV3q4qkPq+PA4zBA4z7vDfdN

Malware Config

Extracted

Family

cerberus

C2

http://20.49.203.83/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

Processes

  • com.ggsrjmlu.rwu
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4271

Network

  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.179.238
  • 142.250.187.202:443
    semanticlocation-pa.googleapis.com
    tls
    1.8kB
    6.1kB
    13
    10
  • 172.217.16.238:443
    tls, https
    2.6kB
    40 B
    3
    1
  • 142.250.179.238:443
    android.apis.google.com
    tls
    5.8kB
    8.7kB
    20
    22
  • 20.49.203.83:80
    240 B
    4
  • 20.49.203.83:80
    420 B
    7
  • 224.0.0.251:5353
    3.8kB
    12
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
    288 B
    1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    142.250.187.202
    216.58.204.74
    142.250.180.10
    142.250.187.234
    142.250.179.234
    172.217.16.234
    142.250.200.42
    172.217.169.42
    216.58.201.106
    142.250.178.10
    216.58.212.234
    172.217.169.74
    142.250.200.10

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.179.238

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.