Overview

overview

10

Static

static

6

ad7ff82335...e3.apk

android-9-x86

10

ad7ff82335...e3.apk

android-10-x64

10

ad7ff82335...e3.apk

android-11-x64

Analysis

  • max time kernel
    48s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    29-02-2024 02:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad7ff8233512617cd296fc15aa7adae3.apk

  • Size

    3.3MB

  • MD5

    ad7ff8233512617cd296fc15aa7adae3

  • SHA1

    58ac62e12b83db6e4ea3543cc2c03f05fc9eab5f

  • SHA256

    2eb9c0cbf4a10a12de885bbcf5ea7e123fc83fd3f14d907c0c012cd4ec8064f3

  • SHA512

    35f043f34957be33414cef2c2c4775dbb63b13fde28f0e0f6441b2b35c30965cceaf3797717d5264977acec0e2beb210c1001c13f315d5fe79b091e1ebf5d575

  • SSDEEP

    49152:htX9AUTidKqdpp5SEdoj5iv2UyxGGnxHmnYjPPyxju2eTcemhi6QoZUCjQs/g+mc:OUPSp7v2VxTUEn2XLhf2VrFi

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://dumpsdeveloper.com/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • width.wrap.sugar
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5113

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/width.wrap.sugar/app_DynamicOptDex/YtUPq.json
    Filesize

    741KB

    MD5

    9f3def0ebdf7cfa76d2d9f37854be628

    SHA1

    ccb91d642f792a8210369b3a5c64f46d8a587dd8

    SHA256

    4f698c5484575080f9bf605115721e2b5e1d1c92713fded4bf7286191d22f566

    SHA512

    159a91dfe84cf4f1a7ebf98e27e8ca7bac8433fade3d900020640003322a2df16c046345b26d3eca6925e143e7c244cc86ffe28a326deafabaf8285a91eb44ec

    Download Submit

  • /data/data/width.wrap.sugar/app_DynamicOptDex/YtUPq.json
    Filesize

    741KB

    MD5

    3996c4e77c41b27fbcf23a6110ae7e1a

    SHA1

    c18e0d56c6ed065cbcc2e8c6b1b1431d4f4b3a3c

    SHA256

    3bf694733fa12c385fa1abe582d51e7e2fae2d53c0f1f29d9a8fc99d9f1b9daa

    SHA512

    7a668ab1b6c14f89409af7e68e73c9bbaf56253c155e90b82237fc691c19c0f2e0ad0c8e3d88263ac00b334c48da2fd688357970846fdcb68378e71b19c1dd5f

    Download Submit

  • /data/data/width.wrap.sugar/app_DynamicOptDex/oat/YtUPq.json.cur.prof
    Filesize

    280B

    MD5

    7585b6f43a5bab71dd11ad7e2bcec3cb

    SHA1

    f7c94704bc9a88f15ac3e01285333b8ff98a3227

    SHA256

    5c47f7e37527e2c06530a00102c9afe054a50a44398bbcc2e60dc7e23659262a

    SHA512

    117a5e6d4159a277326c6aee370559f0aa0441a0c9042b126ff468aa6487937afe0fc42f4712a36e5671311b76bdd598169a3a32f9e987856b3ac72446fc4435

    Download Submit