Overview

overview

10

Static

static

6

Guncelleme.apk

android-9-x86

10

Guncelleme.apk

android-10-x64

10

Guncelleme.apk

android-11-x64

Analysis

  • max time kernel
    50s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    26-02-2024 15:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Guncelleme.apk

  • Size

    1.7MB

  • MD5

    7dd252bc7eb5a0f4af362b30a225b5ed

  • SHA1

    e84bf0c991a22e3dff64231dc1508eeb9d1cbbf9

  • SHA256

    a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81

  • SHA512

    1342e015fc81da1fe16dd0fd32bdba6919517053fdcc45e4857fb85f9d827b040d96a2c3d3c02581a10e2db3b9a0b6d51aa7f233a5ed61474f18f9493c517841

  • SSDEEP

    49152:uUahGKVUaBL2zClijxscjgVunVrgyk/9ygYmhFuONYIc2biMQ7:uUaAKVUaBLfglgExgx9/1hFuONU2biM0

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://162.55.21.189

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • com.share.seed
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4187

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    e55668923d7c9aec5e9e52268f37b14d

    SHA1

    0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

    SHA256

    b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

    SHA512

    ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    decebb743a92fe0a0acfdeca968c5d6c

    SHA1

    d32c12030a200b5caf85a07c09dc063ad5431d44

    SHA256

    a92ea079b1602ca7a43ca2048e16475c2832a1b9b98c9602d30779aff6fb3981

    SHA512

    434557959be34d19c1c0b28a74d55c75aa44e97bab79fb55c03f66d29ae1856e78395976c27af6f3c1f4bf972753ab950339877ab7bb9c59cbfef4d77f2ad261

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof
    Filesize

    207B

    MD5

    cf46b443fff9438f7c8626208956806e

    SHA1

    90992622285e3de555589dcead94ac925922172d

    SHA256

    bfeea598bca301d3e567725a627aa608b177dbaa435118cde7306e9f163ef818

    SHA512

    64dde77926bb3708fdb6ff994bb0a33127a5228f4ba3a500d7516cc724a39f4b4ca334565e35a5fcc131e87a2d32432ea485f3aac0962a81de8198d63e186e24

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    bf3a8b20950af2241e402aa6c819bcbf

    SHA1

    fbe7196d34d9fff857087a88a95df291b02e52c1

    SHA256

    307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

    SHA512

    68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

    Download Submit