Overview

overview

10

Static

static

6

Hadise İf....1.apk

android-10-x64

10

Hadise İf....1.apk

android-11-x64

Hadise İf....1.apk

android-13-x64

Hadise İf....1.apk

android-9-x86

10

Analysis

  • max time kernel
    67s
  • max time network
    108s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    02-08-2024 14:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hadise İfşa.ver.1.0.build.1.apk

  • Size

    2.2MB

  • MD5

    6da5c4e5ecd7550dfd105e0aed822dbf

  • SHA1

    18b28535113c0b0506e7e3e641fad46f8ff1f576

  • SHA256

    4aa281c6840591127f3e01d89f0c5da4e17fb46132486a871c989c5025f04cac

  • SHA512

    4f0a8e8d7670841b2a3f89e14ca0aa23c87b5d5a9e536f595a77f030dbf09caa83737dfdf82ea51e33daf44e44cb84cfdcbea48228d726b8d88696ce5d620953

  • SSDEEP

    49152:/EfByVLZRmnmZ8jD+hrswMg+YXfjdwjjCQQMV2zDOSVRkk+bTm:MfBIQmZ8jShdjvjoCKVSDOiRkk+bi

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://51.81.186.22

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 24 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.mind.rude
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4262
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mind.rude/app_DynamicOptDex/jERuO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mind.rude/app_DynamicOptDex/oat/x86/jERuO.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4287

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mind.rude/app_DynamicOptDex/jERuO.json
    Filesize

    124KB

    MD5

    f3d879e7eb5dccfc5e5c7bc146fb9a15

    SHA1

    78991c42f45ee6d95a03c257162d5040b2443757

    SHA256

    7f4e09b98532c27a86d52ff86e6136fe92a38ff417521de3fc6fb359dc4fad11

    SHA512

    f9ca0946d8ed713aa6f0a19ed4f09aa7934cb7857e00c43c5c55c22a7341750d25d104f147da3f7875e5e41658eecc258f4da0f8eda63554e4b6dd19eb29fed2

    Download Submit

  • /data/data/com.mind.rude/app_DynamicOptDex/jERuO.json
    Filesize

    124KB

    MD5

    b38fa3ee1f65b2d1ae7ed3d53390cfe6

    SHA1

    6b9164362519b18ea4a0b90a2263eda35344ddf7

    SHA256

    82004d68c90f03287999315a5e8d3226b50331cb2a2dd1f390b8650139539c05

    SHA512

    316399b909ce6d26e645a48d1f65985c94e8a970977ea4dc62eef4d276d34375f619ee4f38045f34f920e3f9a4dde621df293087a8f42724e8647bd43335b94d

    Download Submit

  • /data/data/com.mind.rude/app_DynamicOptDex/oat/jERuO.json.cur.prof
    Filesize

    848B

    MD5

    1d7c0cda3cff2701b7b4347e345df599

    SHA1

    b2d8b30b2a55d6ba944e75a40d93b1b12e6eaf5d

    SHA256

    c77a72ff802239ad20cd078cc0f95c6e4452f6c5275f77ea4295d49fb168dec0

    SHA512

    bbba6ba0df2c0c6d66b3b6477ee84441e4208dad5776dde69ca50bc1acd4cee7cc969fa51d3d45c084537167c6bbb5c6a87e117bf77ef5c7fe031f084a8122b4

    Download Submit

  • /data/user/0/com.mind.rude/app_DynamicOptDex/jERuO.json
    Filesize

    124KB

    MD5

    f0fd0f176cd471e68e880eb9bd11f98d

    SHA1

    c25862dfb186640b6d8c091c61e68ad89732a14d

    SHA256

    0d891db82e7729768834f80f892edc2b3404423f4e33981e336e61b3b652fc8f

    SHA512

    8827a5ea2f17a14650a45b4d72615d8dd758953bf77b6b4bfe740908c3c5feb7fe1aa675d5499778d4945ac135d958a574652b5589eea837a5038bf4b26e0e24

    Download Submit