Analysis
-
max time kernel
87s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
27-08-2024 22:01
General
-
Target
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052.apk
-
Size
1.2MB
-
MD5
a9007013ef5f4005a6191e3ebbdaace6
-
SHA1
bc18986a900eb80b807282045b01ee42b951c454
-
SHA256
94fe885650ab9ea7ae18b5fbf22b90f0c9b95d362fbc36f6169d30bbc1034052
-
SHA512
3f9d683822986c51316c70d42bb7c5667c7880770c6edf3c23d1f6521c50491c909f0dda57caeec0db669575d7d90dc0d48c2723f8358c2544eeeef653cd3dcb
-
SSDEEP
24576:mXuuct+RGayS9QtHhEe/F7ihd5jIDfL4KKOZzsWhWmWz:fu0+RGemBEuF7A0DfL4lWhLWz
Malware Config
Extracted
cerberus
http://80.87.192.227
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cargo.machine1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146B
MD5d614d69390edb33a8f7cde3b32068706
SHA157adf6f145922432f8827c5c80cd67b2ede02d60
SHA25662dedd28f111e02479b6e67daf14ce67b0156d278fb834d2a20f07a07be337fa
SHA512416fbb71566d42f4368996e82508935eee96bd9013126d734e7fd7970fe303d69efdd608b9477ac40aa76efcb6d004f6c816ebf28a390899babb3cf50c8d3299
-
Filesize
34KB
MD5421a160a29d093370bf726748a3647e2
SHA19b0b2bf2ee33950b75f003d091457ea47aab0099
SHA256c3c7d4d72af51430c1e43828411cae6a9dc594ad7526b2f0e398296c42595935
SHA512cf04e17aa868d051e256fbc89c741a7fe5a0a29ac6ab67499b830628dbafa8605234bd9448df860f398ec6d8541321aeaf946c21a6f205085cd546776c2a1371
-
Filesize
34KB
MD51f643d49a1f377901b777059714a2e88
SHA181300d41d9ee5409b63501aed8de327f9b69f842
SHA256f241ad166539ae87adbec987385d4e9a8f2157241eb11412f7ef39839c4e8299
SHA512c928029c2c7c0399a7ec5094bb9ab3bfb60f5b96714d89edc8d95d7f620fa0ca674c7848fd44aafeee056e7a86a99156ddfde4c2ee59ddd5812acae138a12ef3
-
Filesize
76KB
MD5262d9655c7d686d31b55aa1976061517
SHA15f6d350e5e6ae66afee5ddddf4aceaf5dcb8899c
SHA256df1baa0be867f09df28532c5078b0c84f1f133e5b33182143f776ae3751779b0
SHA512b660b7636b06b2aff6e4da60346424ba6902a3e247760e211f628b0ad582d36eff04acbba3e600442a0da57449316f458643f49ff34ce82f2cc8dfbe2e8aa16b