Analysis
-
max time kernel
67s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-08-2024 22:09
General
-
Target
7bcbde209dd01cac52b9948fd69bdb2ed3278dd070f80894d8690b39e3210cb0.apk
-
Size
1.5MB
-
MD5
2f58a8d18e508e1ec798f171d7ebc85b
-
SHA1
3e5ac4ff4c61463b6046cb911bacaf3372c06eac
-
SHA256
7bcbde209dd01cac52b9948fd69bdb2ed3278dd070f80894d8690b39e3210cb0
-
SHA512
c102d96e61688988fecfbfdf40121d867125cdb41985c2c46c58444a2e27766e9ce7a8c672ed7ce388e99b4c71e4f697890076c533a54bda0677b9775b5579f2
-
SSDEEP
24576:cM2MJyzY6PnTRWeJzHSCdRvutVTubTe/FT4lb1Ny9zLesWhWmTS+:79JyZgStHSRubTuFTUY9zLbWhLTS+
Malware Config
Extracted
cerberus
http://ashotiksvagonian.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lottery.wrist1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e5ab6140259cbd43de1ccc58a5221957
SHA192a2928b3906e18e2295e61f9d5f1ce5d4715cbf
SHA2561889a991e3c9af1edea38c5fc72a05057ba028e8933dc033ab02274532049460
SHA51299c47f365db54b7c920e3e948eb8935037bca08459b2332c00768b594a7a0a07ded03267482c1b34c756051697d62ff85e5c3285feb64abafbf607dacb456320
-
Filesize
64KB
MD5a4331b0dab2f28c6561395b4de3b51fb
SHA1f37411270484814b8e3917ad0f7d66bc2ea86470
SHA2567ace6ad423ff6ace2ffb063307a64bea1a2f1261f8787ac2ca1e1c525e0a3ce7
SHA512361d9784c81990625c2e1213df37a3cc6890abc3957f72e4a03dd38a9ff9f3c6419cc0bf76a7c03093fa61e7be84a124efae0ddbd47809cb8f48cc15bc49b492
-
Filesize
117KB
MD559176bb00f9315c721bc573c89b0ef8d
SHA10fe6fd13ba98b0cc782c9a40ae1f3315bc793104
SHA2564476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b
SHA51284d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0
-
Filesize
154B
MD558434b44bc1394614803a09288c54ebe
SHA1d030bfb08ed011d50a53f82a63a662fa8bd81e6a
SHA256bbfc83cbb4e4c60308fe25651e1a16beab2f03861bedd31da387b2c2a43c6f5b
SHA512075ed7fc8e2eeb3b74fa9df9ffa381dda2ef68f74cfddd52cada56279289769196ad41e6578132f12ba8abb2b5647e2eb1f0c5083ef37312754f4ec05ef2fc10