Overview

overview

10

Static

static

6

7bcbde209d...b0.apk

android-9-x86

10

7bcbde209d...b0.apk

android-10-x64

10

7bcbde209d...b0.apk

android-11-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    07-08-2024 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7bcbde209dd01cac52b9948fd69bdb2ed3278dd070f80894d8690b39e3210cb0.apk

  • Size

    1.5MB

  • MD5

    2f58a8d18e508e1ec798f171d7ebc85b

  • SHA1

    3e5ac4ff4c61463b6046cb911bacaf3372c06eac

  • SHA256

    7bcbde209dd01cac52b9948fd69bdb2ed3278dd070f80894d8690b39e3210cb0

  • SHA512

    c102d96e61688988fecfbfdf40121d867125cdb41985c2c46c58444a2e27766e9ce7a8c672ed7ce388e99b4c71e4f697890076c533a54bda0677b9775b5579f2

  • SSDEEP

    24576:cM2MJyzY6PnTRWeJzHSCdRvutVTubTe/FT4lb1Ny9zLesWhWmTS+:79JyZgStHSRubTuFTUY9zLbWhLTS+

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceprivilege_escalationratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://ashotiksvagonian.ru

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 2 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
    collectionimpact
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Tries to add a device administrator. 2 TTPs 1 IoCs
    privilege_escalationimpact
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.lottery.wrist
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4271
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lottery.wrist/app_DynamicOptDex/KiuoLHY.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.lottery.wrist/app_DynamicOptDex/oat/x86/KiuoLHY.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4297

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1626

Device Administrator Permissions

1
T1626.001

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

3
T1628

Suppress Application Icon

1
T1628.001

User Evasion

2
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

SMS Messages

1
T1636.004

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Account Access Removal

1
T1640

Input Injection

1
T1516

SMS Control

1
T1582

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lottery.wrist/app_DynamicOptDex/KiuoLHY.json
    Filesize

    64KB

    MD5

    e5ab6140259cbd43de1ccc58a5221957

    SHA1

    92a2928b3906e18e2295e61f9d5f1ce5d4715cbf

    SHA256

    1889a991e3c9af1edea38c5fc72a05057ba028e8933dc033ab02274532049460

    SHA512

    99c47f365db54b7c920e3e948eb8935037bca08459b2332c00768b594a7a0a07ded03267482c1b34c756051697d62ff85e5c3285feb64abafbf607dacb456320

    Download Submit

  • /data/data/com.lottery.wrist/app_DynamicOptDex/KiuoLHY.json
    Filesize

    64KB

    MD5

    a4331b0dab2f28c6561395b4de3b51fb

    SHA1

    f37411270484814b8e3917ad0f7d66bc2ea86470

    SHA256

    7ace6ad423ff6ace2ffb063307a64bea1a2f1261f8787ac2ca1e1c525e0a3ce7

    SHA512

    361d9784c81990625c2e1213df37a3cc6890abc3957f72e4a03dd38a9ff9f3c6419cc0bf76a7c03093fa61e7be84a124efae0ddbd47809cb8f48cc15bc49b492

    Download Submit

  • /data/data/com.lottery.wrist/app_DynamicOptDex/oat/KiuoLHY.json.cur.prof
    Filesize

    239B

    MD5

    d9474337e072da2c0b4fe74ff2249bbd

    SHA1

    38a0f7ed29ddcc436d0f6e2d61961bbfbd76163d

    SHA256

    4ddab34b753c7f65ebc0b8a5a12f5cb3c510c9631123aa18e7b9b911f0ad32da

    SHA512

    87aa5274c4a50436bb45ec9052774ee9162c8b4540444ca55a6b743fa5932ec16e9e4efd918877a1ca7d252e1c8cb8c557c1dfa2cedb570790739038fa47d8a5

    Download Submit

  • /data/user/0/com.lottery.wrist/app_DynamicOptDex/KiuoLHY.json
    Filesize

    117KB

    MD5

    239e52804832bf9f9d8b830bc2fe2f83

    SHA1

    08122f1e0c88e29561d99ac657169df9b30b2211

    SHA256

    19f662f542f0f0b0a68dc8ca119ac73327506aeef30d159d93f41557aab558dc

    SHA512

    4cd6f0a911114be53b9efc38c4a8116ad100014cffeda95ab74867728f21583efd2719aa219fd55d103616a31d05936ac45496182ca96c051e2cbf4da7b39660

    Download Submit

  • /data/user/0/com.lottery.wrist/app_DynamicOptDex/KiuoLHY.json
    Filesize

    117KB

    MD5

    59176bb00f9315c721bc573c89b0ef8d

    SHA1

    0fe6fd13ba98b0cc782c9a40ae1f3315bc793104

    SHA256

    4476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b

    SHA512

    84d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0

    Download Submit