Analysis
-
max time kernel
83s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
07-08-2024 22:09
General
-
Target
7bcbde209dd01cac52b9948fd69bdb2ed3278dd070f80894d8690b39e3210cb0.apk
-
Size
1.5MB
-
MD5
2f58a8d18e508e1ec798f171d7ebc85b
-
SHA1
3e5ac4ff4c61463b6046cb911bacaf3372c06eac
-
SHA256
7bcbde209dd01cac52b9948fd69bdb2ed3278dd070f80894d8690b39e3210cb0
-
SHA512
c102d96e61688988fecfbfdf40121d867125cdb41985c2c46c58444a2e27766e9ce7a8c672ed7ce388e99b4c71e4f697890076c533a54bda0677b9775b5579f2
-
SSDEEP
24576:cM2MJyzY6PnTRWeJzHSCdRvutVTubTe/FT4lb1Ny9zLesWhWmTS+:79JyZgStHSRubTuFTUY9zLbWhLTS+
Malware Config
Extracted
cerberus
http://ashotiksvagonian.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lottery.wrist1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e5ab6140259cbd43de1ccc58a5221957
SHA192a2928b3906e18e2295e61f9d5f1ce5d4715cbf
SHA2561889a991e3c9af1edea38c5fc72a05057ba028e8933dc033ab02274532049460
SHA51299c47f365db54b7c920e3e948eb8935037bca08459b2332c00768b594a7a0a07ded03267482c1b34c756051697d62ff85e5c3285feb64abafbf607dacb456320
-
Filesize
64KB
MD5a4331b0dab2f28c6561395b4de3b51fb
SHA1f37411270484814b8e3917ad0f7d66bc2ea86470
SHA2567ace6ad423ff6ace2ffb063307a64bea1a2f1261f8787ac2ca1e1c525e0a3ce7
SHA512361d9784c81990625c2e1213df37a3cc6890abc3957f72e4a03dd38a9ff9f3c6419cc0bf76a7c03093fa61e7be84a124efae0ddbd47809cb8f48cc15bc49b492
-
Filesize
153B
MD555d23294375d204efd7350359b8edc33
SHA1ca4b3e147f80e2af261307096c422a84aae97459
SHA2563ffd94fcdbc844c0a70b8464e1f2430721608ae0721d33a9253fd3d3606e272a
SHA512e20d60f58f9104b348829125d1a62eba1d34bf17c376e4e2d34bc7609d7c774470bd6e97b221da1d790bd7b3e22df759511c6c32549221fd1ba3f67d4948c9f6
-
Filesize
117KB
MD559176bb00f9315c721bc573c89b0ef8d
SHA10fe6fd13ba98b0cc782c9a40ae1f3315bc793104
SHA2564476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b
SHA51284d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0