Analysis
-
max time kernel
67s -
max time network
181s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
10-08-2024 23:02
General
-
Target
122b7f01026b75d9056032212081b85ef68f28482722efd191bda59e57029f51.apk
-
Size
1.6MB
-
MD5
3bfd50a99f5ae92f4a4cc723578a8208
-
SHA1
e84f0247c345bb131d69234886875192f9300529
-
SHA256
122b7f01026b75d9056032212081b85ef68f28482722efd191bda59e57029f51
-
SHA512
86dd1a7d828c37458194bddffb2e1d8f21c320ab3b3212e6a15afe982e813cc9ff4d3b3ca4794451bff8a8a849d9aa34c9a8f4dd5708652b67417284e76f7590
-
SSDEEP
24576:wbPA4WfLi4wnXKPbQAZSP60tg6pmU4EPu3Ke/FWJU+nLcdQvL5sWhWmMc:EAbDGXKPbQAZitvILKuFaWQvLaWhLF
Malware Config
Extracted
cerberus
http://185.246.66.112
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.poverty.oppose1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD527d5213298d84fd2d5a15c9094e763ee
SHA1ee856ea6c51e8632a05b79305a457734b39f23bd
SHA256c3644ff4bfb19dec4b855d351c178cd2416145e0e98211f3d2ca381b2f122bc2
SHA5126a98912cd26755a568c99798257ff428f2b68b3fe6b019556155fae19b8c4fb4a49b79578882eaafaf5908d0350bc83e4b8b791edafddaff033bfa24e2e1a966
-
Filesize
34KB
MD5275bed8f522aab8aa6c49668c3840846
SHA1c3d19691ab0d43f6f1f445824cd839e20e907d26
SHA256927f1044d5fc9b238fd1ce0a2bf629dbbf62edee5bfe424b8f236e871cfdc8f9
SHA512a24df21843a0894ddfd4c3ba9cedc1f49e8c45893f7f9679b3f4593177bfb4243a1dc619d8658d4df0ec36cefd20250517de6e7b152b6bf90da9cddca6c76443
-
Filesize
76KB
MD51ab89e3f446c274576dfc5436cb4c670
SHA12e2da305e920cbcc5d93fe38fd71d57a80dbdfaf
SHA256bd1b198ed4d71d4132e3c0976aa92042a00a425284ee5a3fc498ae1ee116610d
SHA5121443aea7ad9887616f4e8d77bf30177b38a4a25b77601925c77cdf89790c62e5c274fae24fb7036400f32ff968c127848ecb8c8d6cddaa04d21bd970796c1305
-
Filesize
150B
MD5ba8254775544814d4fba4948cb6c8f52
SHA1057feb042a0227c07893a8a94432f4898fea3d58
SHA256527e52fe08ef756ac530211ec9fc827a6ac84d10376cd6aa1a9735353dc04621
SHA5129afadf9fdf417ee2f14695df826508c28a03c12779f077dbdbd602e42c6bf241106ad19d140410ffa9d31e2fed041e1f3757841daf8518c311a862cf6b2f9033