Analysis
-
max time kernel
42s -
max time network
100s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-08-2024 14:18
General
-
Target
Hadise İfşa.ver.1.0.build.1.apk
-
Size
2.2MB
-
MD5
6da5c4e5ecd7550dfd105e0aed822dbf
-
SHA1
18b28535113c0b0506e7e3e641fad46f8ff1f576
-
SHA256
4aa281c6840591127f3e01d89f0c5da4e17fb46132486a871c989c5025f04cac
-
SHA512
4f0a8e8d7670841b2a3f89e14ca0aa23c87b5d5a9e536f595a77f030dbf09caa83737dfdf82ea51e33daf44e44cb84cfdcbea48228d726b8d88696ce5d620953
-
SSDEEP
49152:/EfByVLZRmnmZ8jD+hrswMg+YXfjdwjjCQQMV2zDOSVRkk+bTm:MfBIQmZ8jShdjvjoCKVSDOiRkk+bi
Malware Config
Extracted
cerberus
http://51.81.186.22
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mind.rude1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5f3d879e7eb5dccfc5e5c7bc146fb9a15
SHA178991c42f45ee6d95a03c257162d5040b2443757
SHA2567f4e09b98532c27a86d52ff86e6136fe92a38ff417521de3fc6fb359dc4fad11
SHA512f9ca0946d8ed713aa6f0a19ed4f09aa7934cb7857e00c43c5c55c22a7341750d25d104f147da3f7875e5e41658eecc258f4da0f8eda63554e4b6dd19eb29fed2
-
Filesize
124KB
MD5b38fa3ee1f65b2d1ae7ed3d53390cfe6
SHA16b9164362519b18ea4a0b90a2263eda35344ddf7
SHA25682004d68c90f03287999315a5e8d3226b50331cb2a2dd1f390b8650139539c05
SHA512316399b909ce6d26e645a48d1f65985c94e8a970977ea4dc62eef4d276d34375f619ee4f38045f34f920e3f9a4dde621df293087a8f42724e8647bd43335b94d