Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    31-08-2024 22:02

General

  • Target

    4de12fec9164d7fb012f9b36ab18204bd4944361adb6e298e1b750761bd60fea.apk

  • Size

    1.3MB

  • MD5

    5a5437f4c0172dcc5be03c0b59f4fee6

  • SHA1

    1a6b07b50c4a7e0fc6e6d7bd9ef2ca9f0cdbb8d4

  • SHA256

    4de12fec9164d7fb012f9b36ab18204bd4944361adb6e298e1b750761bd60fea

  • SHA512

    86460429134c7a5d8e05f2f09a114963059948190c038bebb8f8b344e707bc43ddb792d6739cbe25671d2853b85b1d5a8eb693aaaa07b63c481be152b3b43071

  • SSDEEP

    24576:oM4Mq6eoqSDlp+Z50Syj9NCHksT2FFVHMULKixsm/LInOkm/R5+mv4AwKrSVc:Pfq6vPlM50S4IEuujMmxs4IOn/R5+QxF

Malware Config

Extracted

Family

cerberus

C2

http://sapwatsuop.ru

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Removes its main activity from the application launcher 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Tries to add a device administrator. 2 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.link.visa
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4258
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.link.visa/app_DynamicOptDex/gX.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.link.visa/app_DynamicOptDex/oat/x86/gX.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.link.visa/app_DynamicOptDex/gX.json

    Filesize

    64KB

    MD5

    f1ff7198ab38cb4e65b7bcc130d086bb

    SHA1

    5827b20502d383b502e7b5b21612cce2b25a1716

    SHA256

    ed5c097816f73c2c3d3002caedca5630bb11d50bb22e958346a950df07aeeaab

    SHA512

    966597175763795875cb807198252f8c557e458e7a08aa8f0408601c4ed4a9a34a78a92a7d2ebbd0f1c2053b0d97883604d62fd5f5ba2b0b4580260ee9e028de

  • /data/data/com.link.visa/app_DynamicOptDex/gX.json

    Filesize

    64KB

    MD5

    32ccf10a2a3ae811901cbcce5051dbbf

    SHA1

    04815d79f0a99a2f7649f47f95a61ea7c90e0ac5

    SHA256

    d008472c0ae1119dd6df2e7197979dac459498a1386ff304d6b9e4348c88e9b6

    SHA512

    375de24eac75270ceac01e0efb32e55d6877e10dd2ff6e8c2589f00dc5d8b4e07ef98930a440d254ab19dacd9967421ec5b3b0c9c4dc2851425c39045f40bf74

  • /data/data/com.link.visa/app_DynamicOptDex/oat/gX.json.cur.prof

    Filesize

    222B

    MD5

    0dd9a0ac500bafb708499d63d7d97dba

    SHA1

    73b193b1cc9cd360290e911f8ba43ba8682d4032

    SHA256

    73ad1d498e466e72347c8ae01ad16bc8c91da13e47d58e7c56ab9660a7ef97cd

    SHA512

    38db01e8a6daa13a9828705c5e265244792bcbcbdc2b303dc5d2ef05087c80943e75dc44997cb2524ac38bf133998be3653caaef8d163b0b5c277bb48c51f602

  • /data/user/0/com.link.visa/app_DynamicOptDex/gX.json

    Filesize

    118KB

    MD5

    e1b838a23cdc81de69cb97b2e3ea05ab

    SHA1

    08353775ff15c1cf37df26136a9df86d318d80b7

    SHA256

    8ae7c4edc53d73054191a8c0f3096f04d382eba92e6e765e06dfe9851c239714

    SHA512

    44e4eace7a15b0337a2a58d07b470da6c747e9ebe97dadb4e9cfaf13a01ed504940a62cc71c02a0dfa5e10c880dc94a014feff2fbb85fd3d6389042c1f327ec7

  • /data/user/0/com.link.visa/app_DynamicOptDex/gX.json

    Filesize

    118KB

    MD5

    6ce4981964f8500b60a2e03ad9c6d449

    SHA1

    3276dd791664b38dc6524bc11132fde0c6e53e87

    SHA256

    7226f32c8d167145bffae53471694806701c1b86df3e9f53df546ebf9a4d25a3

    SHA512

    7fddbac8577c4427cece0095ad4d23445162d69785f2c5ab3f15feb186d0722229faa50fad58e8649b1237d4f98851d34be53ae7b2e1b6074b59ad65dcf73623