Analysis
-
max time kernel
71s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
14-08-2024 22:00
General
-
Target
94caa578edb0e096fc50a55cb76d30e9c39f3b63db376baaddbc892d54f718a4.apk
-
Size
1.8MB
-
MD5
4305ccd665b5b13bd392e131b8ca5ca1
-
SHA1
a6947d44d3801bd5f74aafaff7d2b92e621f83d0
-
SHA256
94caa578edb0e096fc50a55cb76d30e9c39f3b63db376baaddbc892d54f718a4
-
SHA512
9fd616b7a2ba81ff35491cbdf7d0589fc89364d91b5ee9422a5cb5409607c398e1b23ac80940a0e9342f91b0d81e1ee77e9596c2058d088fdf8d5c313fb5a0e1
-
SSDEEP
49152:t14Niekk9DRSXiI+ce4/CmWjfHjPtGll22uFXkwZ3LrIem1WhLcGN:OiCbIlKmWjfrtK22KhZ3L8emoCm
Malware Config
Extracted
cerberus
http://ashotiksvagonian.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.absent.cluster1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5651b54993ee2b913a060508441501acb
SHA1c8c77b885c5378166ea6e35e29a3362ca39b3788
SHA256673df94b7fa9fafb14f6b6bf3166292fb0b3ec40d9d3920834f1973cd15fdd92
SHA51263002ffdf27a907fddafd67dcde4f1cc9992f3a11a5a33447f6d4909b8c8128542b84648f1526eb95614353edf48246a51a7d727ba300f687e078b006f23fff0
-
Filesize
64KB
MD5b7ffe626a7d5d29988286f44787ebdf3
SHA1000289230b74a96ce52dbcdbc2b0492e9adb3be4
SHA25675739ce0f855a4b9129e4f76f195aaad5cf2dc2b6c2c6835cbf1a61ece2402c6
SHA512f21e1da091f26efa1668c2b243b65190a9938845286d86d3eed6d27e19127d48576d9889c33e55c3a1de69ff665580c4dcb9a3b5576ce51e605c05323bb2ff3f
-
Filesize
226B
MD53972509c3862d77ba39894ecfe353378
SHA1b893869b1bdab35d2f20e7f01e4354b8a1ceacfb
SHA2566031edbb57c1bf3e9c879fffa65a0e7c6ac9dbc8507c296c801fc96222671576
SHA512125584d487658d59284f576be8bbfd344c30f4a6cd78036493783ef68c43f93de8965b51a0980e5ed691533c2e95ed7f5cc9ebda7ce6867774534c8b0d3e7994
-
Filesize
117KB
MD559176bb00f9315c721bc573c89b0ef8d
SHA10fe6fd13ba98b0cc782c9a40ae1f3315bc793104
SHA2564476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b
SHA51284d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0