Analysis
-
max time kernel
158s -
max time network
171s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
27-08-2024 22:01
Static task
static1
Behavioral task
behavioral1
Sample
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052.apk
-
Size
1.2MB
-
MD5
a9007013ef5f4005a6191e3ebbdaace6
-
SHA1
bc18986a900eb80b807282045b01ee42b951c454
-
SHA256
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052
-
SHA512
3f9d683822986c51316c70d42bb7c5667c7880770c6edf3c23d1f6521c50491c909f0dda57caeec0db669575d7d90dc0d48c2723f8358c2544eeeef653cd3dcb
-
SSDEEP
24576:mXuuct+RGayS9QtHhEe/F7ihd5jIDfL4KKOZzsWhWmWz:fu0+RGemBEuF7A0DfL4lWhLWz
Malware Config
Extracted
cerberus
http://80.87.192.227
Signatures
-
pid Process 4224 com.cargo.machine -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.cargo.machine/app_DynamicOptDex/ofE.json 4248 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cargo.machine/app_DynamicOptDex/ofE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.cargo.machine/app_DynamicOptDex/oat/x86/ofE.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.cargo.machine/app_DynamicOptDex/ofE.json 4224 com.cargo.machine -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.cargo.machine Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.cargo.machine Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.cargo.machine -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cargo.machine android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cargo.machine android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cargo.machine android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cargo.machine -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cargo.machine -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.cargo.machine -
Tries to add a device administrator. 2 TTPs 1 IoCs
description ioc Process Intent action android.app.action.ADD_DEVICE_ADMIN com.cargo.machine -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.cargo.machine -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.cargo.machine -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cargo.machine -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cargo.machine
Processes
-
com.cargo.machine1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4224 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cargo.machine/app_DynamicOptDex/ofE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.cargo.machine/app_DynamicOptDex/oat/x86/ofE.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4248
-
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219B
MD5ef01839c920117b39bf7ff5ae7eb5a00
SHA11d7d9b04c1fb3cc0b73713de8a5c439be37fab47
SHA25683fa4e4b2f3283a74637e1b0b26565778d845ca847a0d011377336c136fbcd01
SHA5127b2888f5c98304b255543746cce0ce462122a34f18e7046f62ec4b77b3ccd517f411c15deca5acc3063814582dbe11aaf02c163258a06ef9abf4360af624321c
-
Filesize
34KB
MD5421a160a29d093370bf726748a3647e2
SHA19b0b2bf2ee33950b75f003d091457ea47aab0099
SHA256c3c7d4d72af51430c1e43828411cae6a9dc594ad7526b2f0e398296c42595935
SHA512cf04e17aa868d051e256fbc89c741a7fe5a0a29ac6ab67499b830628dbafa8605234bd9448df860f398ec6d8541321aeaf946c21a6f205085cd546776c2a1371
-
Filesize
34KB
MD51f643d49a1f377901b777059714a2e88
SHA181300d41d9ee5409b63501aed8de327f9b69f842
SHA256f241ad166539ae87adbec987385d4e9a8f2157241eb11412f7ef39839c4e8299
SHA512c928029c2c7c0399a7ec5094bb9ab3bfb60f5b96714d89edc8d95d7f620fa0ca674c7848fd44aafeee056e7a86a99156ddfde4c2ee59ddd5812acae138a12ef3
-
Filesize
76KB
MD5f65b9c2cccfe676d73f557a3f2d4cefb
SHA1ba8ca12aded8667b7771af6230bce74b2d104cc3
SHA256290fc2c6a696befeabb47b3b84cd2c00cf9a1ec520549f2ec33c688bc254b3af
SHA512a5b0f6f604c11b84ca2add11cdd5c51bdf0fdf2d8208de26384440136e3760053afd394e7e1e0aeb177f7b09fb9b64fa4020a021f2f82020a8d9b409d3b319ab
-
Filesize
76KB
MD5262d9655c7d686d31b55aa1976061517
SHA15f6d350e5e6ae66afee5ddddf4aceaf5dcb8899c
SHA256df1baa0be867f09df28532c5078b0c84f1f133e5b33182143f776ae3751779b0
SHA512b660b7636b06b2aff6e4da60346424ba6902a3e247760e211f628b0ad582d36eff04acbba3e600442a0da57449316f458643f49ff34ce82f2cc8dfbe2e8aa16b