Overview

overview

10

Static

static

6

495a0621b2...17.apk

android-9-x86

10

495a0621b2...17.apk

android-10-x64

10

495a0621b2...17.apk

android-11-x64

10

Analysis

  • max time kernel
    173s
  • max time network
    175s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    30-08-2024 02:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617.apk

  • Size

    3.7MB

  • MD5

    a88a497b3ae6bb84209cac0906df61a7

  • SHA1

    fd80903a98e187bc841a0aabe04528cc1654b8ee

  • SHA256

    495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617

  • SHA512

    684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a

  • SSDEEP

    49152:4GXx4KE5XqsZKV0dw8zbn3A9/HKu84zXYenCh4ebzds31j/D0NcxZBD5I:cz5XqsZDnwxnXYenUP/dsOyxrD+

Score
10/10
cerberusermacbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

ermac

C2

http://185.215.113.42:3000

Blowfish_key
AES_key

Extracted

Family

cerberus

C2

http://185.215.113.42:3000

Blowfish_key
AES_key

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 3 IoCs
    stealthtrojanevasion
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.tafupqzpqgmn.tmnhkq
    1⤵
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4253
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/oat/x86/base.apk.clbwfis1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4281

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

1
T1628

Suppress Application Icon

1
T1628.001

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

3
T1633

System Checks

3
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/tmp-base.apk.clbwfis4529431210935881714.ixi
    Filesize

    460KB

    MD5

    76314acebae3756f201c0928d8141782

    SHA1

    731f5fdcd75802b53e3712b63243b152de006624

    SHA256

    6f0c16b55cfdcbe22208a12afe8ee6799a37eb57d88071eddaf70dd68ef49179

    SHA512

    e2d4624f1215c0368d68955b10d01830cb16f87e646bff0c99d74d791063142f23d0a71c048eaeeea3dcf488b7d8cf00e2fcaccf8ab0b72374b2633f5d190b39

    Download Submit

  • /data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi
    Filesize

    1006KB

    MD5

    785628ac297eefa20b94471cb186e07d

    SHA1

    bbef3134241a11db26e9f092df7aa6d49b188c6e

    SHA256

    43396139d94579d13c5401713829895198dace2e817d33ac3a5b2b7937930243

    SHA512

    cc3e63a211c76264a1873bf06c9282e35c2c68fee1a274f198f75f3f661d5189097454a18b790b7a982ab7e87d67fc1e9682b410a09d6e0876c467f9664ff0fb

    Download Submit

  • /data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi
    Filesize

    1006KB

    MD5

    c9fa87cda7b48167b61083339d8a8a5d

    SHA1

    5713569cada892f482f8f2357ceee3abf67238f3

    SHA256

    5f0679419f6c92fa94c310326fe2c88c3fea2725de9af43066bd487be8d35246

    SHA512

    96e9205c673f28a5e14395272aac2c676cc9cd1fd2454f6a13da69abf1a2f5af3035d4d1c0a24ab7a91762326f3ec96a2ec0aea43b5ca9e3f0ba7edf69c8e332

    Download Submit