Analysis
-
max time kernel
79s -
max time network
167s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
28-08-2024 22:03
General
-
Target
403a25c81ad303156640ece592059acd429e491c553aab64beaa653b5ce66f65.apk
-
Size
1.5MB
-
MD5
a9889c39df611293abc08a715c0a9da0
-
SHA1
2592997005e8fc0bb694ead87505345eec037c55
-
SHA256
403a25c81ad303156640ece592059acd429e491c553aab64beaa653b5ce66f65
-
SHA512
86f4521f4602953584f3fdf168df0c2923e9a7d67c7e9f792c08f9e44be633866d707d8ec132b5b3c266e9637900d4f9683d8569af879d4f23c8fdf547505508
-
SSDEEP
24576:EvIlDGMfzWGAJAPt/xVbEC/zOAetprMmy4EPkIwIue/FJpGx1KJDLmsWhWmR:7l5TPJb8nqS6huuFmwJDLzWhLR
Malware Config
Extracted
cerberus
http://185.246.66.112
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.oxygen.lottery1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5f17c75915fae7b563a714d09c69f510c
SHA160f6e3921290db5ecb20dc2c6ba03bac77082aad
SHA256810e5ed94cb33d3b4f5c2de50bbd114a0f6f0c9364e9fbce4b4d7bff7d6e11f8
SHA5129fcdf4df980f8f125fca0eb186ef99f8c99db8c17a57f50744618acc6e97b9826e02c870abb29c8972d1a29aa1cb22ce429dcc682ba9d083d173444392ae0632
-
Filesize
34KB
MD5cf84d06e04f4afbd789362e200925155
SHA1a0b7065ad5f2e752bf51b276de3faf23168d93b5
SHA256a7fe30816aa4bd54859f5938761afb5bbb0a36a08710c90be87bc61d8c8061c7
SHA51212f16f6734da16cda263501a669e0fc707d3115b86e2c8ed2f279e55c480864615d61248c7b5edb668611bd6ff798bf9ce8694674ebdb7a5501f71b26558d383
-
Filesize
156B
MD504cd9d232a6fb492e50447dfc1fad8c7
SHA13caa8699fe52d00a8448ccf1108cef8a74816f73
SHA256cc06f487c7d1006f7058362d1c26811fd499c43ebc62e4415f804920947b3e38
SHA51256dc2cab6c97179c45532727d26324eb80632a569d0be3b232e071a9792def5afd7f0b6b66133809181d79a1b1fd9ee03d8ac83cb674fa8d92f8329dff39321f
-
Filesize
76KB
MD51ab89e3f446c274576dfc5436cb4c670
SHA12e2da305e920cbcc5d93fe38fd71d57a80dbdfaf
SHA256bd1b198ed4d71d4132e3c0976aa92042a00a425284ee5a3fc498ae1ee116610d
SHA5121443aea7ad9887616f4e8d77bf30177b38a4a25b77601925c77cdf89790c62e5c274fae24fb7036400f32ff968c127848ecb8c8d6cddaa04d21bd970796c1305