Overview

overview

10

Static

static

6

6c3a0cb739...2c.apk

android-9-x86

10

6c3a0cb739...2c.apk

android-10-x64

10

6c3a0cb739...2c.apk

android-11-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    11-09-2024 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c3a0cb739e09bc7fddad12ae5affa9db44f798cd194e9a4602183f4f2c97e2c.apk

  • Size

    1.5MB

  • MD5

    a277166d7af353655d6a0ab7ca21868d

  • SHA1

    3d536e7d43a5d46fe4b1b7f914bc2cea56048dee

  • SHA256

    6c3a0cb739e09bc7fddad12ae5affa9db44f798cd194e9a4602183f4f2c97e2c

  • SHA512

    51464e30fef4462e3430efd1074ada2c873e689225f62bce51f4261808b6782e06d511d432021eb1a7dad98b9c7594c89191543a8b401a1a5e9347342e5eed16

  • SSDEEP

    24576:jP64dlzd0MTHp9EyvaI7IihtbxWmi4EPQS+e/Ff5fhHMffLmysWhWmO:u4d5/THp9EFI7V0uI+uFTsffLmfWhLO

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://185.246.66.112

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.link.milk
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4334
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.link.milk/app_DynamicOptDex/AQGtcgs.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.link.milk/app_DynamicOptDex/oat/x86/AQGtcgs.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4358

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.link.milk/app_DynamicOptDex/AQGtcgs.json
    Filesize

    34KB

    MD5

    cccb87b99f84f8ebc281c323c75b79d0

    SHA1

    8baf110285229441b8529b37fd15cca02ced3781

    SHA256

    0b72acfacd1cf089ce0b97a4f8db0c4acf8f8bfa1f838832c7ee088ff05a722e

    SHA512

    eb29983ac33f876a25a1495173501db644c925afc5e4ee62843aaaa1c42adeee7ab63af285261d488ecd7410268f2173724ac8d45cba0fe874fe9cd7c2041293

    Download Submit

  • /data/data/com.link.milk/app_DynamicOptDex/AQGtcgs.json
    Filesize

    34KB

    MD5

    9274395df377a6dd50cb94ceed649487

    SHA1

    4703c1b3fe35526c386942e0b391826e9366fdd3

    SHA256

    cbc6b9443aaa5532650ebeeffcacef7a3a6ab39fd97c03641c41c36e20380703

    SHA512

    dae49d5ddd0a20b6ff4180c588c58041ed9804e2487d29f8e6dca962ab56ee473ebb6ae2671411393746871c7adc5bdca52d66b683e10baa633a3a21757c37bb

    Download Submit

  • /data/data/com.link.milk/app_DynamicOptDex/oat/AQGtcgs.json.cur.prof
    Filesize

    257B

    MD5

    3cc8c0a93be190e2835f7964e000a6f1

    SHA1

    2791cf389c6d0f70da607435a35fc96794997fae

    SHA256

    597981276dc1d60b1cf8a65ec995f7007f2652d2e93bfe15aee91d816f84fbc6

    SHA512

    68606a99c5756b678bc19cb1ff7fa2f750c9a845a62a23b0aac41f1fad60ca7a611608831a512b416e2adfca7f56f98b548780737b04e3113bb4f3ac4f53d686

    Download Submit

  • /data/user/0/com.link.milk/app_DynamicOptDex/AQGtcgs.json
    Filesize

    76KB

    MD5

    d47b8cabd775ddb118b7d7c3a0741700

    SHA1

    0e09459a78bf05c6631f4dc8ad457ae293240441

    SHA256

    5d3ffe002d8b4a8d99d1b3ce05d2c539bd0140d8907a4ba18050f4536db2fcbd

    SHA512

    2a1c8295647c6ba7137f0a9f01ada22ca084154c27e87beaa0fc6ee77cba02401bc11cd164514613e84c7d59cd452143609df44542c15c634bf6b52a9004e32e

    Download Submit

  • /data/user/0/com.link.milk/app_DynamicOptDex/AQGtcgs.json
    Filesize

    76KB

    MD5

    1ab89e3f446c274576dfc5436cb4c670

    SHA1

    2e2da305e920cbcc5d93fe38fd71d57a80dbdfaf

    SHA256

    bd1b198ed4d71d4132e3c0976aa92042a00a425284ee5a3fc498ae1ee116610d

    SHA512

    1443aea7ad9887616f4e8d77bf30177b38a4a25b77601925c77cdf89790c62e5c274fae24fb7036400f32ff968c127848ecb8c8d6cddaa04d21bd970796c1305

    Download Submit