Overview

overview

10

Static

static

6

ae338ecd0e...cb.apk

android-9-x86

10

ae338ecd0e...cb.apk

android-10-x64

10

ae338ecd0e...cb.apk

android-11-x64

10

Analysis

  • max time kernel
    58s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    29-02-2024 09:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae338ecd0e84e30cb0962d26ea2797cb.apk

  • Size

    3.2MB

  • MD5

    ae338ecd0e84e30cb0962d26ea2797cb

  • SHA1

    04d1634a310fa44282d8abe6763dfd851d84c4d4

  • SHA256

    4a3d77f8c3e8d8ecbbfeda70b661f57dc4d2382996615938c71de6a4cfc2f03f

  • SHA512

    9cd57469232cc692b4321df7eb1b630426f2921611801221212b8abd2a5a75b95d811a43835e8030222c8ca105c0eed850152e4f2c850d34bd1ffccd1c233aa8

  • SSDEEP

    49152:s5V2pYyoevMC7JZ2AMrvHGFOWkMHlkOIdrg3nD2nexrqP+BNfEsholdZOOUkv:5ToekpepQW6neh7ei4v

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://sallamadamarmy100.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • enough.similar.pizza
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4180

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/enough.similar.pizza/app_DynamicOptDex/QdY.json
    Filesize

    696KB

    MD5

    7ff60b8ecf91c892a44d5d085bc7c3b7

    SHA1

    9f9b66295d670d1a4edbe941adde32219a120ea3

    SHA256

    8f538deda8a837a3571283543cb893055d2ff7a68d2340861dcf62e835f41974

    SHA512

    be22ebaa605d5cdcc7a8e3c6611e65790bb06eb64aa1245c48279c3140819d4fb961ac00911c6799620114a1f09b4bbbf3334d60810a8a6c0c3a0405f1f2db7e

    Download Submit

  • /data/data/enough.similar.pizza/app_DynamicOptDex/QdY.json
    Filesize

    696KB

    MD5

    c14439f36c4125ba94ed8136a2fe1096

    SHA1

    d6af701ad82c2c57b3102355297263a0cdc03837

    SHA256

    850bbf0c32fa282303aebda14d08ea0a649c0900d4842be22666ec424736c876

    SHA512

    4ce4dfd4a91c56edccd35f88d21100129ef9dc20e7ad8e4d4c514b2e2160b22263330e41014461d8296ce880c97c067145b8a5669fc0a2c74b30f4ca89f26638

    Download Submit

  • /data/data/enough.similar.pizza/app_DynamicOptDex/oat/QdY.json.cur.prof
    Filesize

    274B

    MD5

    c7f209e1324f6879e8e3775b13f93852

    SHA1

    e3abf249744fa6daf783fb403234ccc6f782ccc4

    SHA256

    b79be15e5401c082e00e02115fc9369141e513501d6bba867653c1bdacb8767d

    SHA512

    b674ac43571e00cf84f26c8389a26844a6791464eaebe08000f3a47423361e27bdea18172bd658c94a2b778dbf5bf7b8de538e9e433a5b3ca9206e701b5f362d

    Download Submit