Analysis
-
max time kernel
153s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
14-08-2024 22:00
General
-
Target
94caa578edb0e096fc50a55cb76d30e9c39f3b63db376baaddbc892d54f718a4.apk
-
Size
1.8MB
-
MD5
4305ccd665b5b13bd392e131b8ca5ca1
-
SHA1
a6947d44d3801bd5f74aafaff7d2b92e621f83d0
-
SHA256
94caa578edb0e096fc50a55cb76d30e9c39f3b63db376baaddbc892d54f718a4
-
SHA512
9fd616b7a2ba81ff35491cbdf7d0589fc89364d91b5ee9422a5cb5409607c398e1b23ac80940a0e9342f91b0d81e1ee77e9596c2058d088fdf8d5c313fb5a0e1
-
SSDEEP
49152:t14Niekk9DRSXiI+ce4/CmWjfHjPtGll22uFXkwZ3LrIem1WhLcGN:OiCbIlKmWjfrtK22KhZ3L8emoCm
Malware Config
Extracted
cerberus
http://ashotiksvagonian.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.absent.cluster1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5651b54993ee2b913a060508441501acb
SHA1c8c77b885c5378166ea6e35e29a3362ca39b3788
SHA256673df94b7fa9fafb14f6b6bf3166292fb0b3ec40d9d3920834f1973cd15fdd92
SHA51263002ffdf27a907fddafd67dcde4f1cc9992f3a11a5a33447f6d4909b8c8128542b84648f1526eb95614353edf48246a51a7d727ba300f687e078b006f23fff0
-
Filesize
64KB
MD5b7ffe626a7d5d29988286f44787ebdf3
SHA1000289230b74a96ce52dbcdbc2b0492e9adb3be4
SHA25675739ce0f855a4b9129e4f76f195aaad5cf2dc2b6c2c6835cbf1a61ece2402c6
SHA512f21e1da091f26efa1668c2b243b65190a9938845286d86d3eed6d27e19127d48576d9889c33e55c3a1de69ff665580c4dcb9a3b5576ce51e605c05323bb2ff3f
-
Filesize
117KB
MD559176bb00f9315c721bc573c89b0ef8d
SHA10fe6fd13ba98b0cc782c9a40ae1f3315bc793104
SHA2564476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b
SHA51284d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0
-
Filesize
151B
MD5b35f5a06afa4502ff919111a2d34f437
SHA10a43635cf6f2c8495688a046cb5fc41f80c01095
SHA2562938f7da406715fe5ebca229dd84795c48b28828f173308dff43c54cbaa0d571
SHA512a19915af70f4965aba673660a3151a099062eae0f14bf118e5f005202bd11eb2cacf2847fb8b7bdbff833832c76b165e3f97ca101398e3ed4287218f1a3a7396