Analysis
-
max time kernel
84s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
06-08-2024 22:00
General
-
Target
eff6b7bde1c49490ad24626fd337035d1d344ec32b0d72e8b9d6faa859ef09e6.apk
-
Size
1.6MB
-
MD5
ac2f494903ddf498c9bc40e516d089ac
-
SHA1
0569a9427d8c8b941462236b839b52c05aec767c
-
SHA256
eff6b7bde1c49490ad24626fd337035d1d344ec32b0d72e8b9d6faa859ef09e6
-
SHA512
6f541ee21207b62ce0ef94b59646e848143c2460eabd27158355d043b5a2a652b4404356fb77cf2143e9be2f662ada36707cb860385422d4d55250ba5ee8d444
-
SSDEEP
24576:TXa+MBamonLRqNoyyQu/KY4ldK5juNvuF3q4zzEAV2pIpMvbGOZAC7mtDvjFa0eO:uvunFsTyQG4lIAXkdV2pJvQC7ubp/e/W
Malware Config
Extracted
cerberus
http://klastersbasters.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.friend.wool1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5d141d83650fd2b628ef0e310f1ea7f92
SHA1cf675c458ed7e201cb5ad5e5c20cddbf5128e3a2
SHA256c13ceb89303c455e039ad59b79adfe4d941d3f937573f95dffc2d41c2799fcdc
SHA512f3e0a0add042698aa16957b06f5dacc788dd3d172ea23148c4449d7f61d42d3355e50023a22761d78549e404f73eea1ee58413f74823ace4fbdd34aadfe71a8f
-
Filesize
34KB
MD55ad812c901c345ac99587236180f64f5
SHA1881c7324b45c4295ffca490c9e59eb8095be37b5
SHA2566abe41ffdb5cffded33dd7353243c975bf82bf92eafb3b0efe95e7b9a9ccb8cd
SHA5123d7950d6e6e17357d90b9f84f0ed3110e3ddc03660a601a7cdd783ef6e2d0b72393fb716ef5f5a33cddf64ad4b152a8a9d531d31d9b548f1cea217ed247cf7c9
-
Filesize
197B
MD5cdd9e993d89fa5347384246ff904d603
SHA1c7b4a2ee401fa30c27611406e7439fab05a97c8b
SHA256d1614efca6e3cccfde4c2ca7e1515887b495c014fd96d48f3d98df4976a6ab00
SHA5129590b2ba239bbe16cef46f958eb17028123e2df804698bb281e7ff13182fd317f3b4feef9956d8ed13bc90f2f3fc52c9e092b055448f959c2764a10bf90b0ab4
-
Filesize
76KB
MD537482302c790d376f129a2a7870c49de
SHA1ead6fa34e880f922f25dfb8757bbc4e1811e9acf
SHA25661b1d3f0da3330fadad0ef253d358b9f801e172e5b2872ca8a4935b35ab8f7e5
SHA5123a2413de0bfffbd231c743e61c728c53e9da042358dcb6da55985129f8e3ec6c50cb122239d2962172f0799a7ac7936f556f06a85ff0c01fedd5ebb2ddda8d93