Overview

overview

10

Static

static

6

ae338ecd0e...cb.apk

android-9-x86

10

ae338ecd0e...cb.apk

android-10-x64

10

ae338ecd0e...cb.apk

android-11-x64

10

Analysis

  • max time kernel
    69s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    29-02-2024 09:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae338ecd0e84e30cb0962d26ea2797cb.apk

  • Size

    3.2MB

  • MD5

    ae338ecd0e84e30cb0962d26ea2797cb

  • SHA1

    04d1634a310fa44282d8abe6763dfd851d84c4d4

  • SHA256

    4a3d77f8c3e8d8ecbbfeda70b661f57dc4d2382996615938c71de6a4cfc2f03f

  • SHA512

    9cd57469232cc692b4321df7eb1b630426f2921611801221212b8abd2a5a75b95d811a43835e8030222c8ca105c0eed850152e4f2c850d34bd1ffccd1c233aa8

  • SSDEEP

    49152:s5V2pYyoevMC7JZ2AMrvHGFOWkMHlkOIdrg3nD2nexrqP+BNfEsholdZOOUkv:5ToekpepQW6neh7ei4v

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://sallamadamarmy100.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • enough.similar.pizza
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4445

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/enough.similar.pizza/app_DynamicOptDex/QdY.json
    Filesize

    696KB

    MD5

    7ff60b8ecf91c892a44d5d085bc7c3b7

    SHA1

    9f9b66295d670d1a4edbe941adde32219a120ea3

    SHA256

    8f538deda8a837a3571283543cb893055d2ff7a68d2340861dcf62e835f41974

    SHA512

    be22ebaa605d5cdcc7a8e3c6611e65790bb06eb64aa1245c48279c3140819d4fb961ac00911c6799620114a1f09b4bbbf3334d60810a8a6c0c3a0405f1f2db7e

    Download Submit

  • /data/data/enough.similar.pizza/app_DynamicOptDex/QdY.json
    Filesize

    696KB

    MD5

    c14439f36c4125ba94ed8136a2fe1096

    SHA1

    d6af701ad82c2c57b3102355297263a0cdc03837

    SHA256

    850bbf0c32fa282303aebda14d08ea0a649c0900d4842be22666ec424736c876

    SHA512

    4ce4dfd4a91c56edccd35f88d21100129ef9dc20e7ad8e4d4c514b2e2160b22263330e41014461d8296ce880c97c067145b8a5669fc0a2c74b30f4ca89f26638

    Download Submit

  • /data/data/enough.similar.pizza/app_DynamicOptDex/oat/QdY.json.cur.prof
    Filesize

    238B

    MD5

    70694905a96f12b28d4f8dad0042b248

    SHA1

    402c26ae4e8b09d991a394be5a08a721f123bb3f

    SHA256

    0ccf846cf56974cadd57cd4544a964d87196733f76963ba5d2a5cc740abbe79a

    SHA512

    1723f3999722914f4f28ba6c520b05880bc49dae8af04202c3b3bf1ee57bf75663b6f9eb4e1f63e6fd9d4ca7533d65b42c767c177b6c9823b9d31eb7e3f7e970

    Download Submit