Analysis
-
max time kernel
55s -
max time network
152s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
14-09-2024 22:02
General
-
Target
fe87e2f86f9c9ff1e8719e110e43d655a1b0dcbc60dee3f42bc665a0a5947965.apk
-
Size
1.8MB
-
MD5
6bafdac2c1bf2e15511709e76b776a5f
-
SHA1
7b544a31a5aca62c3ffb6d8c5c9f1b261e73a88f
-
SHA256
fe87e2f86f9c9ff1e8719e110e43d655a1b0dcbc60dee3f42bc665a0a5947965
-
SHA512
68c3d1d61b29633c0e42875152af7d92bbc92da4c6c7fc666d65b0cd6bead760e5c2a9d2b9f5202f60b017fc9877a83b0d57e12b660b5aa68571fd333a936178
-
SSDEEP
49152:b02ALmXKvHIvuf8/Ucd34uFbs3PlSwfLAjemYWhL0Dd:jALmsI2f814KofkwfLwemT+
Malware Config
Extracted
cerberus
http://ashotiksvagonian.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ocean.size1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5a825df98785ad6f50ac89df74cae8a73
SHA1a44f99a9d3655571921bb82bfbc2f6f650900aba
SHA2569fa54f380c1a74a674b278c86d411684f821b1933e96d55db01eed2fd68fdf3e
SHA512b2ddea5cb2eb16655d62d6f3e7e8a91c0030ed0d4094c1ca8352193cb525e2e21c2ad64c847780a997795bc5d6ae85a1430c5ec5baf1e5bbbbf59ed535d97927
-
Filesize
64KB
MD5f15721b0ca2f2f54658b41d06974b131
SHA17a4ce6a8b8487a9b4fb3e16d45fc718f46e32ec5
SHA2566b898243ced9b13615912db088b6fd0d9286004814b4ed623a223aaf422fbb66
SHA5120acb6f02792202dd8461adfaba185ef274a3d8e3f1989407137278e290de1ecb6f9a40b3ae0e09e21c1ca506c154e87ee4c35b5e0102575b6a42a1f4b353e6fe
-
Filesize
247B
MD5e51c61ab099e4a6a4747c8a4857a9133
SHA1124d91385bf5c6d1aa8b7bd7128d18dbb6bc464f
SHA256e002515035bedf9f54ea115539fccce65e0c62a7992d0dd4184b03a54881b999
SHA512aac581583e4904446c0aa2ccb8779bd1452a5c5a73cf1497f018cef942c5bacab7eaa7d6d57ffd7990df6b8a1802c508cb0e05b0ee0acf2d86bb1b5afd4d8df3
-
Filesize
117KB
MD559176bb00f9315c721bc573c89b0ef8d
SHA10fe6fd13ba98b0cc782c9a40ae1f3315bc793104
SHA2564476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b
SHA51284d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0