Analysis
-
max time kernel
147s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
11-08-2024 22:17
Static task
static1
Behavioral task
behavioral1
Sample
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00.apk
-
Size
1.8MB
-
MD5
bd412fed97a1d57ed0b3dfc42c3da006
-
SHA1
a9cc2b94669b1131df2169a3f7e178137d0df71c
-
SHA256
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00
-
SHA512
e1ebb9cb15d303bc6c697277db077732702024f909925facf7f21989fd3f266e54d85642a45e9f3fc1f7c718b1b9b1e07b6b7bed7d7acb38ea64f152e7b386a7
-
SSDEEP
49152:nqwNMHoD+P/351zuFLXhGEfHLtSemrWhLdg:nWHoD+H/zKxfHLsemKo
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
pid Process 4303 com.before.dizzy 4303 com.before.dizzy -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.before.dizzy/app_DynamicOptDex/QrrgBAc.json 4397 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.before.dizzy/app_DynamicOptDex/QrrgBAc.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.before.dizzy/app_DynamicOptDex/oat/x86/QrrgBAc.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.before.dizzy/app_DynamicOptDex/QrrgBAc.json 4303 com.before.dizzy -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.before.dizzy Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.before.dizzy Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.before.dizzy -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.before.dizzy -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.before.dizzy -
Requests changing the default SMS application. 2 TTPs 1 IoCs
description ioc Process Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT com.before.dizzy -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.before.dizzy -
Tries to add a device administrator. 2 TTPs 1 IoCs
description ioc Process Intent action android.app.action.ADD_DEVICE_ADMIN com.before.dizzy -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.before.dizzy -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.before.dizzy -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.before.dizzy -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.before.dizzy
Processes
-
com.before.dizzy1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4303 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.before.dizzy/app_DynamicOptDex/QrrgBAc.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.before.dizzy/app_DynamicOptDex/oat/x86/QrrgBAc.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4397
-
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5759f40a67aa27617338fcb960a24b613
SHA12487a96c129b26baed165d416b4a37c99cc44ae3
SHA2566ad9db242ea4704c12cf356bd5b410cc5e82c4475a33657e013b81010b9265cf
SHA512793b170c49295111537a6e2a4458db2860f314869853d67b108a452d7c76b5a4b83ab892989d722086ca841c6b0afebd6a6aa46601b4401a088f392c1cd71a42
-
Filesize
35KB
MD5835efc2e57cc63697c9365001788766d
SHA11c6887e6f413649b50f4e7c59404733d6d16914e
SHA256feb49508c2560bdf7cbeac1ecc30a981c343e381521b763b3aba3d598ae347ef
SHA512bb07c43fef35d537a881a37bcf98ba002f2edc08a6432efeba03a630fe6f95c87250a7477e75085fd11360c8b51944e49bcdd5a157f35fd16368416934f5e89e
-
Filesize
249B
MD5efde7fbc3bafbf59106328a23cba35c0
SHA190882ef32ae81698d698106053fb7a5aac5bd035
SHA2563fa233784ba3757b8f64a0ea9d311729bb2734696433a50f3871543308969573
SHA512dd977e5e8db036951f3b31c68295fd96d39e47cd17887d2ac80d3819643331d8851274841c30eba68d4170752c434ed68a778397dcfc9508c5b29b43d3e36b20
-
Filesize
77KB
MD59dfa580aa93694ae97b83ecb5cfa9ff5
SHA1b17c51cbd1dad8b069e2ac3adab7fccfd6bd624f
SHA256caaa953fc8d5eb5d2cbac6e280ed76c7e3ddaa2f0f4eb2ed5e7d58b7b7015ddf
SHA51222c51103d9bdf7997ccb6557c92613f431b9c643a1825d4264fd4767a0f1f8e66b8f2719ccbcda1bf5aae2c9448729212e722b6d9091a4f1c7eb6cb6bdb034fb
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe