Analysis
-
max time kernel
48s -
max time network
138s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
24-08-2024 22:01
General
-
Target
650c9df44edba195d5cf54f123d5ba94ab7377ac76786b6b36a57629b0f23626.apk
-
Size
1.2MB
-
MD5
0fb790bbc6541e2854f910c2a0877629
-
SHA1
8d2ef981d650881a880517fd70abc86251fc6624
-
SHA256
650c9df44edba195d5cf54f123d5ba94ab7377ac76786b6b36a57629b0f23626
-
SHA512
a8858897fbeff9ee4e9d941de8ca7c958be37e741debbf3f7b54979c135065aa88759c6b30b124ca3babcff7911194dd7fa2b95cdff8e868c1fb6427c8cc7056
-
SSDEEP
24576:MMzMTNv9c0a0CtC5ly1pRpZR3BVW/aB7y1GLxHF:rgTNF7a3CDy/Rh3aSBqaxHF
Malware Config
Extracted
cerberus
http://sappzaebiservak.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.onion.flower1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ae50b7adfac3fb6842c2befb9b21bf7a
SHA15555e1652f80e25f977f5d5c69d486ef7627df89
SHA2565870e1d94c066591c3e83373484a2f3b211e6a01498db6c02020daebee897376
SHA51244fff2765dc006f3c760b5722ec94ce344431b65574242472fdaba051d04cfbdfb08f79e4810769af232e7f97986c677d42fb7a030cbf37f3043dfdea728decd
-
Filesize
64KB
MD5147beb4cc1cff1de96c554fe369e5fb5
SHA1fcbad83c61480230778b6c087524b1d5ff34e6a7
SHA25696780c8fe47e3422689babd91ce4da3d18da2be70a80bc5e8e0579f437f89267
SHA5126863a3e259c3664a0d279e11921a0d44fff5bf7d7daa168c39d368b77353e79fbbbc2f94b3627316d783311424978bcdc1c2b956307549df6aec5ae6dc2b3a07
-
Filesize
236B
MD54536a76da2845ea81576464e8f8f6e9d
SHA12a3c2596d4b643f160283df79b337491869c4a1f
SHA256f0a19e4f78e3ab115c1d40b80ed089ac4628f4e748a18b597f7e47c02dd6d915
SHA5127b149bc7869a26be6c011f200c73a5b1f53d7c6ce82305af7e5b682a17162e5eed1867062cef7916526a5a03852b2d4051fd74de174d4fffe015df044390c076
-
Filesize
118KB
MD508f818e7b9a7b3d91d0c64db2adfe623
SHA11e17fc5a6bd7d29307dd04df8bbc4edeb9680e1e
SHA256252acf5a3ea28210b475900263cc192c3422984522b5e7e50e7ac18bd2e579e9
SHA5126177922b522f05f44ad45c82d9719bf718e9bf44fcd8354f01339feb0ccf657d5ffcc4060cd37544f116ad55e28c3a64b31f31ab5b2613a935229d595fbcfa36