Overview

overview

10

Static

static

6

b46a0305df...56.apk

android-9-x86

10

b46a0305df...56.apk

android-10-x64

10

b46a0305df...56.apk

android-11-x64

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    05-03-2024 09:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b46a0305dfbcb341dad439a88cd67c56.apk

  • Size

    3.1MB

  • MD5

    b46a0305dfbcb341dad439a88cd67c56

  • SHA1

    3ddf314f3d8c66037fcc76cb7a4148d11a55e9e3

  • SHA256

    29149f72818601df2e9df222a3167c832e9c4caf0d9e9c281889336200d68dd7

  • SHA512

    99cb4d86f139aa30860b0ffbfad98d72f95f018ab2bf0f611719dabd384eac81b5f0e8dcbd6eeb9b4c4dc9e1e25381f16aea5adfe9f7d21cf8ecee3f28f01488

  • SSDEEP

    49152:y3ZBJkFMbk0y9HCZfDEjU8qCjWgQ0HRNXOz4DiWrbT9HqI68bOJf+b15YGROOUvI:yuGbk19Kb9Gc84UiWrB6861I1Kb9w

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://ratrentalservice.com

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • raven.tenant.forum
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4270
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/raven.tenant.forum/app_DynamicOptDex/rWQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/raven.tenant.forum/app_DynamicOptDex/oat/x86/rWQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4296

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/raven.tenant.forum/app_DynamicOptDex/oat/rWQ.json.cur.prof
    Filesize

    905B

    MD5

    8a8d0d7e7972ff6b5883ac369ead666b

    SHA1

    e1a97724c5b7c9bb624dcad44a67dd47601adabd

    SHA256

    bf10875c0132af68d484852f63935708a8f0c8f0ceb9e54558f22967624fcb80

    SHA512

    158c15aa904188c621cde6053b3729bcb0daed814cab633dd9b8d587e7138f8836f946e8ed9c7551c04e4d5139b759a8551d0279205c40311c0c112e92e9c7f2

    Download Submit

  • /data/user/0/raven.tenant.forum/app_DynamicOptDex/rWQ.json
    Filesize

    801KB

    MD5

    d03fead3b34e2fc98d5e1f86a53eb5c3

    SHA1

    6d8a9a7939c518ffde2528a42e9e37a816dc41d6

    SHA256

    58c75abc38546efd7237941d1c9732fe6c65dfd56852eb2cb633f22859203a46

    SHA512

    4921f1bdf7f20ad63f00f7e38dd97f30c6e3c9d59d7a41fc3fa848f0d48aaff048c5f1e104e2fbec7f0307fedb000e0920e604859bf8ef55d652ef224e1d9702

    Download Submit

  • /data/user/0/raven.tenant.forum/app_DynamicOptDex/rWQ.json
    Filesize

    801KB

    MD5

    83de487436714916327ad33fc2ffa7cb

    SHA1

    478b1a093824c40e7dc5f6b88650d06cf2362d4b

    SHA256

    e8977f529770998108569031f4a93513de6aa2426963d6cd9c2643d7bd420aae

    SHA512

    f41f063c637689ba1514b25a102a92292f21db3211c2fd102a4549fbe9c8c990d95e7f5ca55b29ab62a1eea26f7f7c4d9e1571ec9b2671af69b7b3f077ca4491

    Download Submit