Overview

overview

10

Static

static

6

Aleyna_Tilki_Ifsa.apk

android-9-x86

10

Aleyna_Tilki_Ifsa.apk

android-10-x64

10

Aleyna_Tilki_Ifsa.apk

android-11-x64

Resubmissions

15-04-2024 19:09

240415-xt4dssdg45 10

07-12-2021 21:35

211207-1fk7vadbbm 10

Analysis

  • max time kernel
    82s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    15-04-2024 19:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Aleyna_Tilki_Ifsa.apk

  • Size

    2.2MB

  • MD5

    c2df5601485a33aa2feb1cb3b00e1bac

  • SHA1

    3d1d4445e5daa4e88adca360e45da9277c60eb4d

  • SHA256

    731c0da8d74adbb557a0abd4ec2aa6c61e09d429560d76549881f08e564b27cd

  • SHA512

    7af0ca3260d826dee08e9a0097ab0cf2f05ad626751aa58815c37b03360b4a5d660cd86b87b4df58fbd4cf37058c0b5114de505248dc9aa35fd5a01f489380b1

  • SSDEEP

    49152:7mqf+e8Gt15R82zo8pHuxwmzxXHb2Vee82QTJf5GPQSQPza46f9JA9ETwQTZt:iqfwGt15R828EH3+XHb2ce82QVQQSQPa

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://31.187.74.114

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.bulb.maid
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4228
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bulb.maid/app_DynamicOptDex/dMqSfxR.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bulb.maid/app_DynamicOptDex/oat/x86/dMqSfxR.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4255

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.bulb.maid/app_DynamicOptDex/dMqSfxR.json
    Filesize

    124KB

    MD5

    d798d005171dbab39bc53d14ed8d6c6d

    SHA1

    5ba7b51f8fcfc5f2a51542828a310cc7e776086b

    SHA256

    8523a905d81394d92993424b63f427c93f6e1a5ada741457ac0805eda5503cc5

    SHA512

    4f7a0ec9b17426fe2f7ec579b8a819f8ba1affc5ebf21fe19ade50b11d5389df8fdeaa33665fdecd82b5c33dfad259995d363df65100a530cf1eea50bddb08fd

    Download Submit

  • /data/data/com.bulb.maid/app_DynamicOptDex/dMqSfxR.json
    Filesize

    124KB

    MD5

    f1b6b21e49c4b2e80fb260a81405dfb6

    SHA1

    d6304fffec5f162866cb2b712d0fd94cfd70f3a7

    SHA256

    49a737c094086e84c8edf6bda0ee5407ef28c8eb08a5e89516f3329aff1a3d45

    SHA512

    827a0f7aa316657f9e411684f17ef1cb103ea7020f683446ab9cda60a855faae810254b987ea614647e71b3bfb123b8313ad067bfde0a087f40ea7d1b4fd1ad0

    Download Submit

  • /data/data/com.bulb.maid/app_DynamicOptDex/oat/dMqSfxR.json.cur.prof
    Filesize

    809B

    MD5

    2fc739f59b044bc5a56f9c6fd8d03073

    SHA1

    ad0f663c4d5f39c4f0b6b4dd86c1b25a22d24285

    SHA256

    094561d51e8441d06f005e0261722016591c69c3920084b3edf6cf7a2247a8f5

    SHA512

    f7c78988053c51b98402fe80ca0785848fe992da9661d7b565ff161a569c705a7914157f4d58056fa942ca0d0117ef59b290961788d8a6705acca523370e7942

    Download Submit

  • /data/user/0/com.bulb.maid/app_DynamicOptDex/dMqSfxR.json
    Filesize

    124KB

    MD5

    1f221d729713d37e8d3e70cad825bc82

    SHA1

    7ea1594c665216c148bf11601b6236be1e6f29b1

    SHA256

    4389d1e2f963efdb36c1491e31a907adbe46f161a6b8d76e806bf6a31389fd6f

    SHA512

    d2a9f58b5575c2221d9f82ccac85aee5bb220c6f35a2f7b96a41422f46693571c8cfaf7a13ead63abe0b00555963bd219e00366bbcb26a9405e7d439f9da485a

    Download Submit