Analysis
-
max time kernel
107s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
11-08-2024 22:17
General
-
Target
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00.apk
-
Size
1.8MB
-
MD5
bd412fed97a1d57ed0b3dfc42c3da006
-
SHA1
a9cc2b94669b1131df2169a3f7e178137d0df71c
-
SHA256
0d54afe5bf4a3fa2eb0989f3f197b7e948bbccb66b7b8cb41ef4ebcf674e9a00
-
SHA512
e1ebb9cb15d303bc6c697277db077732702024f909925facf7f21989fd3f266e54d85642a45e9f3fc1f7c718b1b9b1e07b6b7bed7d7acb38ea64f152e7b386a7
-
SSDEEP
49152:nqwNMHoD+P/351zuFLXhGEfHLtSemrWhLdg:nWHoD+H/zKxfHLsemKo
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.before.dizzy1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5759f40a67aa27617338fcb960a24b613
SHA12487a96c129b26baed165d416b4a37c99cc44ae3
SHA2566ad9db242ea4704c12cf356bd5b410cc5e82c4475a33657e013b81010b9265cf
SHA512793b170c49295111537a6e2a4458db2860f314869853d67b108a452d7c76b5a4b83ab892989d722086ca841c6b0afebd6a6aa46601b4401a088f392c1cd71a42
-
Filesize
35KB
MD5835efc2e57cc63697c9365001788766d
SHA11c6887e6f413649b50f4e7c59404733d6d16914e
SHA256feb49508c2560bdf7cbeac1ecc30a981c343e381521b763b3aba3d598ae347ef
SHA512bb07c43fef35d537a881a37bcf98ba002f2edc08a6432efeba03a630fe6f95c87250a7477e75085fd11360c8b51944e49bcdd5a157f35fd16368416934f5e89e
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe
-
Filesize
153B
MD5891386bb57034c4ead051251daf13563
SHA1c672fc7abab183897deaa4179dfd50ddd90d3d27
SHA2564ec3a59a083a173e760dd88f9b90feb0db91cb5afe117061183909d1bb86abab
SHA51271b10d018ce3b343c5462f5143fd265c8767bf802717e9699288e3559774c31ac7872d12a86ba0ac78423751a6fbcb21008700ab609be4e7a22149e70075c00c