Overview

overview

10

Static

static

6

bda0dc80bd...d5.apk

android-9-x86

10

bda0dc80bd...d5.apk

android-10-x64

10

bda0dc80bd...d5.apk

android-11-x64

Analysis

  • max time kernel
    61s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    10-03-2024 04:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bda0dc80bd225022dee98d7db05ffad5.apk

  • Size

    4.6MB

  • MD5

    bda0dc80bd225022dee98d7db05ffad5

  • SHA1

    11569c6f438e2e885165128d43c382698674d743

  • SHA256

    b8a12bb24e1ce1724ddec605f6c1c70f4a61273f8fc9cc76572f22531e3b871c

  • SHA512

    2116b71a0b02a95e990be1f031223d10e1110c193f20b50f7efcb7293e75e272acef6ff837b53ea72e37d5d016681adf25b8559becc958cf35b10a1532904514

  • SSDEEP

    98304:OH2+Gi6XUxrPgz7WItf0U1yvL2wJldXF5F2QdWZwONdpwWN8ge:OH2bigUxrPQ7JJr1yvLDJl5F2Q0rdpt+

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://144.126.152.229

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
    evasion

Processes

  • loop.leader.athlete
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5051

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/loop.leader.athlete/app_DynamicOptDex/oat/nGU.json.cur.prof
    Filesize

    281B

    MD5

    41bf9c346bc876adf5cc227970ea2d8c

    SHA1

    5725073112a94caed765c68f0190d684fe9ec26b

    SHA256

    23f807aaa1974f4648ed3ebe32e07b4b327a3e4d7d902d0bae2693c171a4f36a

    SHA512

    8c81f613dc06b762293cdb4e2cd2cc1a4b798e75c56bc398c2bc2180899622237df40a29f3df1a532fd5400f620d6f67a3b54b8f16c779b5bf1fe8321104b83f

    Download Submit

  • /data/user/0/loop.leader.athlete/app_DynamicOptDex/nGU.json
    Filesize

    650KB

    MD5

    3880ae785a9f64e3786e136277e31678

    SHA1

    c3e4fdb5c8986ac64fa8f647e4b7a76b07b7e0d6

    SHA256

    3448f80eba25143e4bba073f2e0ba617445e30bf1db8da3a2f10bea6709e148b

    SHA512

    8e531285a0ab68ae6e420e56ef03d82458e5e42c9629dbe738e6435245383bad6353541911ca882c5f72ee465045f1d4057d5c611fffb0c17e1cb2a4703d53c5

    Download Submit