Analysis
-
max time kernel
52s -
max time network
189s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
13-08-2024 22:12
General
-
Target
67cd817067fb69009c703790d934d0fd5bd91fe07c3794ed122d1e05117af011.apk
-
Size
1.7MB
-
MD5
3b3510206376f40ddcb49749cebc3675
-
SHA1
6690e1139fc631a61341a9e6dd396b1e308a4553
-
SHA256
67cd817067fb69009c703790d934d0fd5bd91fe07c3794ed122d1e05117af011
-
SHA512
1f53891075db165fbf76b6bf19d934f044b1af826b3bc48dab5f5b7a41442b650d374f6a5c11e608baad9b412f990c22b1523d6b57b6bdc0cb4de81a9b47cf06
-
SSDEEP
49152:0QPbak2LLgXFlFYz57wuFT/sXfLnjx0OemLWhL2Dp:F2LLSFluhwKYXfLnjxNemqot
Malware Config
Extracted
cerberus
http://23.88.39.169/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.engage.strategy1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD589501e1b75488c6ffa4f018418e84178
SHA1fc8f339326d6904a727cbc2fd85e7ada0a5010d3
SHA256cb81a4f4538e4a15b1d30b0d74afc2b3bba336d5f16f227592ed34f009264d0e
SHA512a44beae59bb0b6688a8dd73f17727d9fa55ddec95a9a268cd1cdb54ae27e636bb10af22889b0fef625bffc987bec7db4a8b4b47db4bcbbd75f70f8b529a832fe
-
Filesize
54KB
MD53f337f268e30adb5d24836762907eb01
SHA1500e506dbf8fcec763edcd8880539a88521efdc6
SHA256fa817d1f75592e354d472d2e35e0a5f3e9663554518e44af1cfd0c28436cbfd3
SHA51235fce443d9845e32b733943168ea0aeca9914e57053817e1cc3727fb531115eb929691616986a1ca5d273d2865f869708c52cef92165cb65533d905f9689dbe6
-
Filesize
822B
MD5eb636976fef6713db3f6948e57e837d5
SHA125824fe788e9379ea5b5d4a8b7e940e31416f13d
SHA256798bca966e826bc0d613c467e3450d7e3438e9d6716b953723235d96f0fbfc7a
SHA5120bcf26fac6020e0fee0a92d9c2bbe5148a6b190ec298aa9638d2a737c033ebeb68c1174439baa8c5dff0e2f539cbf4d2e716cc4ff86a2321475806aecf8bac11
-
Filesize
103KB
MD5f1a58d337f8c376bbdedd82f64272faf
SHA1be06259b7068208e9a98549a5718356c19eefefd
SHA256b9ec0e81785988df6d1bdfe5d3cd069b8071ef23a2526474ec2765c8cf124935
SHA5123f6c4e2182ffb9bc1cba45da262b448610ee4228cafed6947b11309ad4095b4fa24322a59c2a04c05efdf1cdab2af638171b28d958d663600e4673b5c7966ec1