Analysis
-
max time kernel
142s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
25-03-2024 03:43
General
-
Target
dd270c4680162ff3dc32ef54af37ee5c.apk
-
Size
3.2MB
-
MD5
dd270c4680162ff3dc32ef54af37ee5c
-
SHA1
c74378e7489b682a84b0457d158b8d6c068707a0
-
SHA256
9767d501e9a5c1f125d568645e42f057884258ceb38d1641a99a219b77dd3ba1
-
SHA512
31c09244b7bfa7b6d2591f1181561e9517159bc0ecc56e9b9aee706d76c9c60816fece798c9715085ce9bd2d9dfb559951b1a76af6958cacd8f9228949d03542
-
SSDEEP
98304:7Ua0ymRUaKDkw+tkAn4mqpGp8wqzj0YuCuo9S9:H0y+KDoeAnhq0ewqzwYum9C
Malware Config
Extracted
cerberus
http://androidservice.cf
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
fog.toilet.melt1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
587KB
MD558d259c7678a56678f0ff1be2ef0a647
SHA1f814936cb6db2a4dee9f50d7a20950ef4e7326ab
SHA25676965e54aa5a0cf7fe02c97a0c746fd911f5e65c0c3d00e17b5a7ddbe7efbb15
SHA512f1df76c3e5a21878c5ddc384358b3d18d2ea1750745cbd38e2eb811813ddebde209e84b1a7df29dd702986d0e3a736718b86600f9d063a0979121e8a1c9aaea0
-
Filesize
238B
MD543ef416d6bea2b4e390ed919619641d0
SHA1821b748682b80982056adf8b589c9c17101b83b6
SHA256605dd6430c5bb93245f5d2fee8a1d62e3b4717501dab1f15fd0f75d33b8439e8
SHA512f75fb9e61b1b258daf2f9b71e04a194824480b9f4c10272d012ffdcb3ec203b7f229a1a81a58272e322c8e391ddafd67f3b6daf940ca1ee44e1b132427c930fb
-
Filesize
587KB
MD57d0dab0b3b9f618aba0162d923bde06e
SHA14e1b6a7a5a9b05575118f6a962d201aced5b81f3
SHA2564e477985a5de3ebaabbe8db381f83cdb4e1bec12906e120fc063d760193cd8f5
SHA512abeeec718b4ff60826163f0ca8a0de6de460668c4b05c010f9d8332ecf04e355a1e7a16bea720dca6abf2f2bf54e2c30bf028fa97d389ad7d44bb5bbdbf767b3