Overview

overview

10

Static

static

6

ad7ff82335...e3.apk

android-9-x86

10

ad7ff82335...e3.apk

android-10-x64

10

ad7ff82335...e3.apk

android-11-x64

Analysis

  • max time kernel
    62s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    29-02-2024 02:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad7ff8233512617cd296fc15aa7adae3.apk

  • Size

    3.3MB

  • MD5

    ad7ff8233512617cd296fc15aa7adae3

  • SHA1

    58ac62e12b83db6e4ea3543cc2c03f05fc9eab5f

  • SHA256

    2eb9c0cbf4a10a12de885bbcf5ea7e123fc83fd3f14d907c0c012cd4ec8064f3

  • SHA512

    35f043f34957be33414cef2c2c4775dbb63b13fde28f0e0f6441b2b35c30965cceaf3797717d5264977acec0e2beb210c1001c13f315d5fe79b091e1ebf5d575

  • SSDEEP

    49152:htX9AUTidKqdpp5SEdoj5iv2UyxGGnxHmnYjPPyxju2eTcemhi6QoZUCjQs/g+mc:OUPSp7v2VxTUEn2XLhf2VrFi

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://dumpsdeveloper.com/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • width.wrap.sugar
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4266
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/width.wrap.sugar/app_DynamicOptDex/YtUPq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/width.wrap.sugar/app_DynamicOptDex/oat/x86/YtUPq.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4293

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/width.wrap.sugar/app_DynamicOptDex/YtUPq.json
    Filesize

    741KB

    MD5

    9f3def0ebdf7cfa76d2d9f37854be628

    SHA1

    ccb91d642f792a8210369b3a5c64f46d8a587dd8

    SHA256

    4f698c5484575080f9bf605115721e2b5e1d1c92713fded4bf7286191d22f566

    SHA512

    159a91dfe84cf4f1a7ebf98e27e8ca7bac8433fade3d900020640003322a2df16c046345b26d3eca6925e143e7c244cc86ffe28a326deafabaf8285a91eb44ec

    Download Submit

  • /data/data/width.wrap.sugar/app_DynamicOptDex/YtUPq.json
    Filesize

    741KB

    MD5

    3996c4e77c41b27fbcf23a6110ae7e1a

    SHA1

    c18e0d56c6ed065cbcc2e8c6b1b1431d4f4b3a3c

    SHA256

    3bf694733fa12c385fa1abe582d51e7e2fae2d53c0f1f29d9a8fc99d9f1b9daa

    SHA512

    7a668ab1b6c14f89409af7e68e73c9bbaf56253c155e90b82237fc691c19c0f2e0ad0c8e3d88263ac00b334c48da2fd688357970846fdcb68378e71b19c1dd5f

    Download Submit

  • /data/data/width.wrap.sugar/app_DynamicOptDex/oat/YtUPq.json.cur.prof
    Filesize

    917B

    MD5

    da8d999aed5f3eb3994ef030ddeb7e82

    SHA1

    c7555ab816b4c9df12c13c2bc89d890fa97c707b

    SHA256

    21a85eea6324bf3b55e351d046f374ffe9eac3ca21b7f30cdbd39d9f8a71686f

    SHA512

    d555af34384919cf7da7952b6156939de8e8b56d16cae8d57ff60c21850d3e6ead3c4ef914a21170434a9dc22b562d6df6de88182e75467ae858455f58181ea8

    Download Submit

  • /data/user/0/width.wrap.sugar/app_DynamicOptDex/YtUPq.json
    Filesize

    741KB

    MD5

    00c63baca13438906d187b48d48d836d

    SHA1

    02db5dab3b08a45c0c85057a7c571331e5264506

    SHA256

    d32059d4dff99319db5beafd4bec993e2c0891f5c1f8fd2bb08cffd7a7813907

    SHA512

    d713cf7d3189c0aafbbdf4bd6881778795773c184a30bc8413a0ac5ee25583b225c4d5a3110f34533337a7158c6f572d08c3f8df0759d7c80ec0164d5660eda8

    Download Submit