Analysis
-
max time kernel
71s -
max time network
137s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
13-09-2024 22:04
General
-
Target
371321f88e33bce3c5b74725f5303db9653984b79b7f92ed87c16b2701890a86.apk
-
Size
1.7MB
-
MD5
8da3213385cab456fbe25a21b42aeea2
-
SHA1
4099c5900d6e0fa70743724fc24862a895047865
-
SHA256
371321f88e33bce3c5b74725f5303db9653984b79b7f92ed87c16b2701890a86
-
SHA512
36e2ac4ec85c99400b79f2612e289c3fbdd591971d4ddc93e5f718baf8165df85b8b8e2e84b3ca43b35a5f730be0d3ae0ca84e4bddd247e59f0f75f872a384d2
-
SSDEEP
49152:veZmNZsuJqKKKKKKoi+M1PlMVakm6hpsxTGff+fdb8:ve2iKKKKKKldlMVaCpsJK4A
Malware Config
Extracted
cerberus
http://siteecmod.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lonely.medal1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD56588ceea1f873b3bf3d374ab0b8ced4c
SHA113f43175f9bc4c7f4acee1853de9b94f8f130f24
SHA256649b456f6de43742bc6dd0413cb802e1ec38991fa2c033106972c2ec0abd5314
SHA512c835c50ae920ed789237c4b5edd25d93c16e851c832bb30b37e6c0f63d07d0eec762bf40f9b58deb1463a9a958d38473ff9471076cafb409e1a3aaef6d050f39
-
Filesize
35KB
MD5c71cd24422f0fe6993576445ae4d18ba
SHA130eee138911592d4f9949cfb055b586244abc880
SHA25699b96c8b1b76ad72e618443e5f355906ad2381a911fba14223acee954b6d6a87
SHA51231386982ff8bdd43d7c05f31140c951e587e0f7be29ba4b1a3a496af97f5b849f38611aea459caf982624f7f1b11b57a3716cdeb83ab86818709ecd411bc3bc1
-
Filesize
35KB
MD5483be3219a352f34fcf7033280d00433
SHA1c88d6c6de9ee6d807a428cb4b07157e92073d0f6
SHA2566849e34f7e8e13d7fcc401a2c5d5b7f93c0993fdbc463eab2c07f1602ad8df72
SHA51263d52f5f6293e65451bf055419b17d0b14ba1e99097bc53276491f9879c7c7bf4385917182ecfc43bef63d3b2925a0a433acb3ea5392a7693ee1b6efdd4f616e
-
Filesize
77KB
MD588c1ff7095821039a92e5da2e0a97eed
SHA1c2c715ac56e253ccc21ead088fb940da228d84bb
SHA256c2d68306ba492b062b8683ae6b80de7bf356117c9473bea63c8934318d2b9ae2
SHA5125d2a957510cabf56bb7b2e268beda174d4d9c11aaeecddedd008ce1696e3fb3438402fe4bb35c4dd0cf1eee4b506528412f71e95f5ee29e0a222607f8f27864b