Analysis
-
max time kernel
73s -
max time network
181s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-08-2024 22:07
General
-
Target
ba26bc717ee0f40707320e55ea904a4cf257a0f9ede732dfcf320f182616763a.apk
-
Size
1.2MB
-
MD5
5f78b69a087302ae624da7c82cb20525
-
SHA1
4b969b63a8dcd70984b2d0e3bd5a064d970807bc
-
SHA256
ba26bc717ee0f40707320e55ea904a4cf257a0f9ede732dfcf320f182616763a
-
SHA512
e87c68b09516c51605477cb06d068b900a62e0e665b47ac87d6fc64396bb306d23eeaa6dcccb3d34d0da11812d6d9ea1b0137a4241f5681381110b7230cec7e1
-
SSDEEP
24576:xzzbVvonipZmG1qpOWSnyt8woe/FvXxPrI5MXLdsWhWmgK:ZbVgn+mG8Q1WZouFvBGMXLeWhLgK
Malware Config
Extracted
cerberus
http://80.87.192.227
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.opinion.tiger1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD569496f4b89e72a173da3e1245b32bd50
SHA1bced9c97c2b607af63cb2701a1e3a079a62a15e0
SHA256f2a47626c692131fe08a8abc1f16881fcbe3cb8caa5e102fdf4e46c6aca0846a
SHA512a5124e54a8c1260c3b60cd269c97e9031e5b87c577d326d4e227864701c4cd90019f8c0c0955305775c3225721b8793f4cf553f49accd8e17e481da6fb4a5b3a
-
Filesize
34KB
MD5a77cbac04c186838e52812e3224db24c
SHA1e9635ac549e0e610a60d72114320756b440fa27b
SHA256e1b098985b82a3d12a4c8937553a66d85a5294f88ca55e17d9eaf180af2022ca
SHA5123b93351d2267cba34ea0e559a303b8b24c87f4cc49c295507dee7580513b4dab83aeee072aaeda6467808b9412548e0fb66effa05875a0b355c88d104f1acf01
-
Filesize
76KB
MD5262d9655c7d686d31b55aa1976061517
SHA15f6d350e5e6ae66afee5ddddf4aceaf5dcb8899c
SHA256df1baa0be867f09df28532c5078b0c84f1f133e5b33182143f776ae3751779b0
SHA512b660b7636b06b2aff6e4da60346424ba6902a3e247760e211f628b0ad582d36eff04acbba3e600442a0da57449316f458643f49ff34ce82f2cc8dfbe2e8aa16b
-
Filesize
149B
MD59c061a67968389af68f25cb0b4d8e6db
SHA17bb626ee9a66794552b19d1f08e0b7a06e30d320
SHA2566c2c1351b67f24314a2b747dd509dec21f2ffabd4a7bb9a06baacd1041f8ac3e
SHA512b751e8eea853871eeb3a3fc059299e284e427b87036ab76f8a7785fb91ebefa93c41fd73de2cbdb51a4c65a53bb952122749e41488bb5d2a3ee842f80098edeb