Overview

overview

10

Static

static

6

9FFDA0C1E8...B0.apk

android-9-x86

10

Analysis

  • max time kernel
    36s
  • max time network
    38s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    13-08-2024 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9FFDA0C1E8E9E9C63C5219941F3F72F04EF8027B2ED8443498100DF27E00B8B0.apk

  • Size

    1.8MB

  • MD5

    725898490828771711e487a67aeb149b

  • SHA1

    b146d8812c79e1cd7b46127efe26aaaaa668b4f2

  • SHA256

    9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0

  • SHA512

    24884a2d340e7ef032c7d0e117624c731dc97e7f1a966d9e059740e962970c8681446f857acc963668ba7d4a46b5e5baec33050a5276778cd0c5b416167bed3b

  • SSDEEP

    49152:mpGJxMZEDaeHWqYaVQdk4Vc5RTSijsztY:wGJe+OeHWqYGQdkThSiAJY

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://teknoasaglik.online

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4243
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/oat/x86/CLgH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4279

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json
    Filesize

    791KB

    MD5

    d3dffc453a8761be6d45825a501ad430

    SHA1

    75d1529a3425c7e49aa67d90f751e3a78b66e359

    SHA256

    60ef60157445a623636d55e81347a2f0fc322a1c8d98a0421f269330e6401734

    SHA512

    04c5031249a9db1074f413de9b910236af5d86b5893a7388627e8e72baf05b20ab029c4c215b4aa5e4c4133c64f24527f2d6e246e6fbe11c7c4d1de6956f11e6

    Download Submit

  • /data/data/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json
    Filesize

    791KB

    MD5

    b6dc5b2f98e5c26b494e6b5d21900dc7

    SHA1

    1aeeab5f0e028e536e9f34a9711c27e8c26cbdba

    SHA256

    058b5927de385c9daa9ef67731dd912e9ae4265b43ca676872e18db9aed3f228

    SHA512

    8b9928b5ad1a44f8bebe593f0fd12bf46a457a0a2d20afd2b73013528df1f901ca07190a71ab4739afaf63db6c9c39c9f10c277609385c5395c4dfdeebcf351c

    Download Submit

  • /data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json
    Filesize

    791KB

    MD5

    5c1adda056dbad9805c14dc3a38b6879

    SHA1

    5126d1deceaff66e49d08fee7ff54b145f46bdfc

    SHA256

    e2215e492b19617f741c7dc4e5b8e25523579aee5564e37b33b8430a4e7068f9

    SHA512

    1071660c03b6e27cb786acc461694f776869bab4bc9478dc40ecb0ad29b3460a0dc9e4946d84872f0ee03e127e5ae33d200402980fb6adc7893721231f399da5

    Download Submit