Analysis
-
max time kernel
77s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-08-2024 22:07
General
-
Target
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932.apk
-
Size
1.6MB
-
MD5
c60da6d1e301b79a510bf49fb3c20b3d
-
SHA1
339fd4f68724054fe1e129a87564e834af0042e8
-
SHA256
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932
-
SHA512
00c7d735f18bf995ee8ad0e09b51eb93d6f5d6034b6734f762c9666662e00cbcfde8f50fa3d087a2dd59233711acb41bfefd86dcecae091f2b2eabaa46928491
-
SSDEEP
49152:dih/BBuG+0gPMhReFCd9d7uFrtE3fL1mylemXWhLpAv:dih/B0GrJr7KC3fLdemmDC
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.estate.buyer1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5350a922fc331f441991f3ae0d15d9e33
SHA1c5ed717abd5ef148296441dabdf50c9c029d4657
SHA2560887f9b42a22e0b3562e7379e6e7491feade412202b199b699ed365783d9665a
SHA512dfddfe45c42924de81c0632f28a8e52dcd87c20b40505528d226e7efb167d29f83f89a78b2c9399d9e6148c217df03588a7bc98079e321f46216c232cf5569f7
-
Filesize
35KB
MD513fc3664d1ac01f699e55e3a9daaeeeb
SHA1a880af01c6b4d1631b3f0ebc126ff50ee535f5d5
SHA25607e5a40f46ada147d9d80f8768dc0df3108ad4b8803d766eb022c01fa2603973
SHA512f5eb104db9f5da488c3ae6c2edcdaf7d17e9ad3e205897837e3d5192df449a1e75ed5e5c402f3f14bf01ce342229621c2274d89113ee6e20f785ae45c42f5fbf
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe
-
Filesize
148B
MD50950826709fb1524bcbf649b2f3d420f
SHA12d6db7e25e11ca566f62259ec8d8894957e1ad1d
SHA256ed3962fd5853ecabdd62b0db98546d518a7cd90ed39f98c4850693efdd7d1844
SHA512af67c7544124fe8d9cd1fcb1edefc1c0c255133401371bcf10cb6035570ce3fa3bd8f51e4c80c87e8328554f9b1cd7d831c309ea4d5ba97a12a1dbbe805a37bb