Overview

overview

10

Static

static

6

01b3b89a53...a3.apk

android-9-x86

10

01b3b89a53...a3.apk

android-10-x64

10

01b3b89a53...a3.apk

android-11-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    08-09-2024 22:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01b3b89a530dd692da807e0d0324ef5099d93ae7e220f447bd3484b7d86bf3a3.apk

  • Size

    1.6MB

  • MD5

    f9a1ec15f99cdd100d31057961f091e8

  • SHA1

    3f4abb83b466b2e19b643ed28c3f8b194995ba72

  • SHA256

    01b3b89a530dd692da807e0d0324ef5099d93ae7e220f447bd3484b7d86bf3a3

  • SHA512

    ca4b74050d361863ccbc12dd114733fa89167071a2bfba8df7a7971610f8ab6cfb1d4c1c9c65e864dc0545ed78009bd8f7bf16a915c79dcfce77c2ece8df695f

  • SSDEEP

    49152:cxasaf/VJleFskg9d7uFrtE3fL1yemCWhL7P:cIsaf/VJlCT87KC3fLsemRl

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://94.250.253.26

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 2 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
    collectionimpact
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kite.stamp
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4305
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kite.stamp/app_DynamicOptDex/IslcIkg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kite.stamp/app_DynamicOptDex/oat/x86/IslcIkg.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4330

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

3
T1628

Suppress Application Icon

1
T1628.001

User Evasion

2
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

SMS Messages

1
T1636.004

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

SMS Control

1
T1582

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kite.stamp/app_DynamicOptDex/IslcIkg.json
    Filesize

    35KB

    MD5

    1cde128283d66523e3906ca670c21e83

    SHA1

    b33028064debc7cd8e12581a765d744de2233ab5

    SHA256

    c9a5126f1564fca9210a840a29a76715ad1f9842e8f0f240a97bf883fc5d07a2

    SHA512

    604c76c9b9c1d25f9a280a60e536346d62d765922bd92c96cd905f1142631ef534d0740ac38f9810f0b3cefb7e32a0353553a6a8d5b561d4763adbbffc1865e9

    Download Submit

  • /data/data/com.kite.stamp/app_DynamicOptDex/IslcIkg.json
    Filesize

    35KB

    MD5

    1706e4a4e80cecdd15d74cc4ff689ac1

    SHA1

    cd6e6685b389efa8dd2449d3e8934bde99c3981b

    SHA256

    e2343b6fe969759c45071ccbd8f49659105c2a6cca20e9ef291e0953e3423db0

    SHA512

    971f2fbd10dbb1337ae9e1816f2c5ce3170d26af1eb02280dd2ff062d7d6bdc6e36a429737c468427ed0eb7bb2de254e787821a8e3fdcefc41f216c12aaede6e

    Download Submit

  • /data/data/com.kite.stamp/app_DynamicOptDex/oat/IslcIkg.json.cur.prof
    Filesize

    239B

    MD5

    fdae8eaf82d41e471c61072958ec7592

    SHA1

    0fc1dec3d25fc17d36cfc26ab313bd4b58d5dc38

    SHA256

    ae37539d3cd8a4e82ead0e4819ce4a6a9e96c6f1d3a22972b92d56181c3d0c31

    SHA512

    b716b157b93dc28ba48a809121693b4c497b16004cb4c26535d0c81dd179cc89ebd3da1f74108c46512f79847e7bb2b062d75baf6b828649da00e28b5fbcb22c

    Download Submit

  • /data/user/0/com.kite.stamp/app_DynamicOptDex/IslcIkg.json
    Filesize

    77KB

    MD5

    9dfa580aa93694ae97b83ecb5cfa9ff5

    SHA1

    b17c51cbd1dad8b069e2ac3adab7fccfd6bd624f

    SHA256

    caaa953fc8d5eb5d2cbac6e280ed76c7e3ddaa2f0f4eb2ed5e7d58b7b7015ddf

    SHA512

    22c51103d9bdf7997ccb6557c92613f431b9c643a1825d4264fd4767a0f1f8e66b8f2719ccbcda1bf5aae2c9448729212e722b6d9091a4f1c7eb6cb6bdb034fb

    Download Submit

  • /data/user/0/com.kite.stamp/app_DynamicOptDex/IslcIkg.json
    Filesize

    77KB

    MD5

    fbfec32963eec74794d898179aee8b56

    SHA1

    cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

    SHA256

    d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

    SHA512

    f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

    Download Submit