Analysis
-
max time kernel
76s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
11-08-2024 22:17
General
-
Target
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00.apk
-
Size
1.8MB
-
MD5
bd412fed97a1d57ed0b3dfc42c3da006
-
SHA1
a9cc2b94669b1131df2169a3f7e178137d0df71c
-
SHA256
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00
-
SHA512
e1ebb9cb15d303bc6c697277db077732702024f909925facf7f21989fd3f266e54d85642a45e9f3fc1f7c718b1b9b1e07b6b7bed7d7acb38ea64f152e7b386a7
-
SSDEEP
49152:nqwNMHoD+P/351zuFLXhGEfHLtSemrWhLdg:nWHoD+H/zKxfHLsemKo
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.before.dizzy1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5759f40a67aa27617338fcb960a24b613
SHA12487a96c129b26baed165d416b4a37c99cc44ae3
SHA2566ad9db242ea4704c12cf356bd5b410cc5e82c4475a33657e013b81010b9265cf
SHA512793b170c49295111537a6e2a4458db2860f314869853d67b108a452d7c76b5a4b83ab892989d722086ca841c6b0afebd6a6aa46601b4401a088f392c1cd71a42
-
Filesize
35KB
MD5835efc2e57cc63697c9365001788766d
SHA11c6887e6f413649b50f4e7c59404733d6d16914e
SHA256feb49508c2560bdf7cbeac1ecc30a981c343e381521b763b3aba3d598ae347ef
SHA512bb07c43fef35d537a881a37bcf98ba002f2edc08a6432efeba03a630fe6f95c87250a7477e75085fd11360c8b51944e49bcdd5a157f35fd16368416934f5e89e
-
Filesize
214B
MD52c42cc81cfa43909878a671730e865dc
SHA194edd945a172240c26b5fcbf2202a59a0885eddf
SHA2562aef55074f702d890747e29f40ad94d60b4e08e1204d3f49e84a4b8568d4f9b1
SHA5127b698326bc2497d3d8f8aa8b57190bed8e7d73bc6ce2997bbfbb473fb61c708d61e3451152dc961d09984dbc87d188234625a1760773c827014823fd55bee048
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe