Analysis
-
max time kernel
98s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
28-08-2024 22:02
General
-
Target
2ce8b8fa2796f5237fc344f0fa60142f0ce2a28f92a2e7248ee50f55ed1893b8.apk
-
Size
1.1MB
-
MD5
a51c9fb03af915096699edcede0c2b6b
-
SHA1
feda184495b4433c203b6964fa7588333b649895
-
SHA256
2ce8b8fa2796f5237fc344f0fa60142f0ce2a28f92a2e7248ee50f55ed1893b8
-
SHA512
8e1e214e4913035f319c6ede29b1f0bf7fe95f16b66565c50072a8d9b655864d5e6c9b346d4ad139957e7e84cd1a9e52d8263d6d0db31ed88613207c88a84e48
-
SSDEEP
24576:DM0MOe+hzqmfWIYvG77sOHkhu987EEmqVJNB8WmSU7coOZzDKxf7:wTOe+hzqsYvG7pkhu984C7U7coa+xf7
Malware Config
Extracted
cerberus
http://sappzaebiservak.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.banner.burger1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD578905977ea044c98aafbcfc1d278baf7
SHA11d99819f49323ed11522fb02a76392b7559ad696
SHA25695b7325508c785bf595aeb11b6872d8379d98231fff5a41523564d4807588c3d
SHA5123990fae0d08af78a5774cfd1fc77bb558bc2b6001b5e506cec2df784a1e1de6fcd0c78d118ba03d7d336dc33a439e30d5732fbddf354667c2abe55a5dab318b2
-
Filesize
64KB
MD5f413c2d2f5609baffa8eadb699f42031
SHA12381cb8cff36eaa0ed7a154c015ad4ca04bf1abd
SHA2563b71b95d66c2a415e3c3ee0fd555e28e328938f83d42f2a104945a520df43653
SHA51226bf83eae0bda899969445ad9438a2d8963942ed4c39395472eea126dd9cc87a60d51adfc663c8e51c1e397542e13566d9502c86f9291d24fa53dd379defb8fc
-
Filesize
203B
MD5cf958c1ecaa0b60ca95211d89a05ce32
SHA15bfeff3fde1ee21f19acd5e564265cf27daa7a65
SHA256d6a664e3daaec238d90a89fb70b073137852467f49627bdee10caf39cde89706
SHA512dc9c2255bd08fb6c15452613c36e0f73049c344541c59860720f25e7d05cccc7c8ef8f15a2a626eb6652def248a8e3eb2a50c29ffd881ad4d89834545e901468
-
Filesize
118KB
MD508f818e7b9a7b3d91d0c64db2adfe623
SHA11e17fc5a6bd7d29307dd04df8bbc4edeb9680e1e
SHA256252acf5a3ea28210b475900263cc192c3422984522b5e7e50e7ac18bd2e579e9
SHA5126177922b522f05f44ad45c82d9719bf718e9bf44fcd8354f01339feb0ccf657d5ffcc4060cd37544f116ad55e28c3a64b31f31ab5b2613a935229d595fbcfa36