Overview

overview

10

Static

static

6

dd270c4680...5c.apk

android-9-x86

10

dd270c4680...5c.apk

android-10-x64

10

dd270c4680...5c.apk

android-11-x64

Analysis

  • max time kernel
    64s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    25-03-2024 03:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dd270c4680162ff3dc32ef54af37ee5c.apk

  • Size

    3.2MB

  • MD5

    dd270c4680162ff3dc32ef54af37ee5c

  • SHA1

    c74378e7489b682a84b0457d158b8d6c068707a0

  • SHA256

    9767d501e9a5c1f125d568645e42f057884258ceb38d1641a99a219b77dd3ba1

  • SHA512

    31c09244b7bfa7b6d2591f1181561e9517159bc0ecc56e9b9aee706d76c9c60816fece798c9715085ce9bd2d9dfb559951b1a76af6958cacd8f9228949d03542

  • SSDEEP

    98304:7Ua0ymRUaKDkw+tkAn4mqpGp8wqzj0YuCuo9S9:H0y+KDoeAnhq0ewqzwYum9C

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://androidservice.cf

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • fog.toilet.melt
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4238
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fog.toilet.melt/app_DynamicOptDex/mqLFu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fog.toilet.melt/app_DynamicOptDex/oat/x86/mqLFu.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4267

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/fog.toilet.melt/app_DynamicOptDex/mqLFu.json
    Filesize

    587KB

    MD5

    58d259c7678a56678f0ff1be2ef0a647

    SHA1

    f814936cb6db2a4dee9f50d7a20950ef4e7326ab

    SHA256

    76965e54aa5a0cf7fe02c97a0c746fd911f5e65c0c3d00e17b5a7ddbe7efbb15

    SHA512

    f1df76c3e5a21878c5ddc384358b3d18d2ea1750745cbd38e2eb811813ddebde209e84b1a7df29dd702986d0e3a736718b86600f9d063a0979121e8a1c9aaea0

    Download Submit

  • /data/data/fog.toilet.melt/app_DynamicOptDex/mqLFu.json
    Filesize

    587KB

    MD5

    7d0dab0b3b9f618aba0162d923bde06e

    SHA1

    4e1b6a7a5a9b05575118f6a962d201aced5b81f3

    SHA256

    4e477985a5de3ebaabbe8db381f83cdb4e1bec12906e120fc063d760193cd8f5

    SHA512

    abeeec718b4ff60826163f0ca8a0de6de460668c4b05c010f9d8332ecf04e355a1e7a16bea720dca6abf2f2bf54e2c30bf028fa97d389ad7d44bb5bbdbf767b3

    Download Submit

  • /data/data/fog.toilet.melt/app_DynamicOptDex/oat/mqLFu.json.cur.prof
    Filesize

    904B

    MD5

    ce6f34cc4d8a926c2d6668eb4dc389fd

    SHA1

    75e1f9503e12e0b5d68e589ff1dc0b1d3f3c5912

    SHA256

    b1188611fda7650168f6a1563eab476ca1e02b4f9d6c7297af6236d61acbc6b5

    SHA512

    6cf8a0f39cce46956e025bb84f424fbc1ba1343aada39d5094ca0b9915178b9c162be5779b714ee131047873225bb0cc7f7f7d2f2f8ae57fae5fe6fc342567e9

    Download Submit

  • /data/user/0/fog.toilet.melt/app_DynamicOptDex/mqLFu.json
    Filesize

    587KB

    MD5

    80b03db01f8391af87e871b53e2c8a8b

    SHA1

    53d3243f3f4c14645987544c6cafdd16ea1a4663

    SHA256

    5f4803055552bd38b4b7d56d051488998ea25aa96f7b8c82259a0664a6e823da

    SHA512

    2ce412115d1d525442248462ba5c4a27085d2a7a9af0885d532c6091836ea25f82675977873fe350f22d959f8ef08fd1f0ac2fae3701f77fd09fe056bac9b71f

    Download Submit