Analysis
-
max time kernel
70s -
max time network
174s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
18-08-2024 22:05
General
-
Target
668dfd58ab661e0492d37e6f34a5b26934d6f123116b3fa6865d68b93b2244f7.apk
-
Size
1.8MB
-
MD5
7549c5f9005ce0894b0ad7ba0072fce7
-
SHA1
6c14c0994b1f53fb498b51aa40f25ff776db9080
-
SHA256
668dfd58ab661e0492d37e6f34a5b26934d6f123116b3fa6865d68b93b2244f7
-
SHA512
69b2c02e33575186fa2111d97a2304fd298de88ae281aebf113383c8e04949958b52781b1cb1ff5889c8d1d7c32111c13278e28d793c7727d5a924c57bdec714
-
SSDEEP
49152:kSD3XTf8fqZZUVKiV+Vs99+NubRL6OTu9ZuFPBoBHLLYemJWhLX/:kI3XTOqZZ4df+sbBVaZKWBHLkemcZ
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.silk.grocery1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD50b3adde3e2ac0ebddb4f5fb49f13690a
SHA1e2e6ed18c8b80b17c552f4e975fba9b42beb52d6
SHA256f3684a64cf5b54e5452128a3e7f715ed163e57214208a90854692acd6c0286b1
SHA51200928b1d29080b7b416be73610d0a895a288c37564834680159da4b14c9ee6f10d64a9a5ff41eacae647cd6556e1457f784d2da72ef5ecf293c98d706f8b48aa
-
Filesize
35KB
MD532e900a7510986bd618aedbb5f252842
SHA1ca1593efe2e24d4159091eb7e89efd312ceb1c38
SHA256de721969d079c1bde17ebc950a3750e7846e20204ee43a2d8fccb13e07011015
SHA512692f0d09bfb38d9ab8095ff4952cb2eb942ac7958d4d2dbb51b8ada09902b4eea641812aeae7488509838a0e7347a96151c07e0ca4e962d6383e19add706734d
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe
-
Filesize
141B
MD5715e49e4a1c81f84a3981ac90c9ace48
SHA12a2d0592bf9b9bacad1ef95dfc1b8fd0e7ba3555
SHA2563a816e59238359b7e58fa6ca5910c0224f36ef4eec5e8c5e55f07a7dff4e31b2
SHA51213ef8c532dff1b9e9b6198bacdc48ec534466f3f17cf36feb350ad1776732a1c014293df99568545d2cf4166a444821e2dc294e1bc4db84d9979e5465296ec7f