Analysis
-
max time kernel
84s -
max time network
171s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
10/08/2024, 23:02
General
-
Target
57990e111be3e5f5dde47041547604d3cff8ac155eb1dd0fd3c09c4c3baca893.apk
-
Size
1.8MB
-
MD5
17f57399b70ede566fbf6c34c330071f
-
SHA1
ca25deaec19570f59fe0695ecf8ad00beb237c78
-
SHA256
57990e111be3e5f5dde47041547604d3cff8ac155eb1dd0fd3c09c4c3baca893
-
SHA512
2f392e0832f0eee4e9c7e4943d12cd3ab8b094351880523cd87485e17ed7ef0a881a99cbc5cef4fe977a0730c07cde85cf4708ed49bb27d41575d683ba4202bc
-
SSDEEP
49152:21ksPksJQ0nIuF0FexH66+9l3uFzWcDXLheemTWhLql:235tFCC63K3DXLUemis
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.coconut.direct1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5fd5377a2cab2f6229d85cc391c3a2563
SHA1397af4e05023f2b8794849f077557049a3d368de
SHA256290c3c5e3c25567628616c72b633327e3b0f2e264bb04c20ba6f83da814c0999
SHA512e136a1c83c2adf104a63fde0c4efb5d181626473791546c28a9d1d19e985eba15db69c6711a2368836c0d8c0a17fc23be00abb7931cd31b1817356db00bfef3a
-
Filesize
35KB
MD58b64519eb3505f5ee9a62c1f35f35af7
SHA16697dde4fa8020e33ce81599ee7099342481d22b
SHA256f4a33171a6f6cafef7ec675308ab61bc70cbb42375fb4367198b9f022de56e92
SHA512023e55526ed76750b04fc5e00df3baab97c55402b03f21e459f14c5ef3ed24eab31e8d5d56b840c5da2de884b1239d320d1b4b025eb7958b64c4ac1b124e2ede
-
Filesize
206B
MD50f1a5e0a3dc168919da77268a4e8a50c
SHA1e6bd9d57e8fd04f1b909561ce6d98f4ed536fa6d
SHA256b5c56f140a164917d3385d344db78828c1dfd37f0232e5d518e9aa380039a009
SHA5121f7536aad60fe14d9b562a7e20307c0e75464e6bb032a045720f7bc0d5da2100ba7796fb91d1af8b39e833a7a8ad7eb138f3b50dd0d02357af9ac1dcef55d5c8
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe