Analysis
-
max time kernel
69s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
14-09-2024 22:02
General
-
Target
fe87e2f86f9c9ff1e8719e110e43d655a1b0dcbc60dee3f42bc665a0a5947965.apk
-
Size
1.8MB
-
MD5
6bafdac2c1bf2e15511709e76b776a5f
-
SHA1
7b544a31a5aca62c3ffb6d8c5c9f1b261e73a88f
-
SHA256
fe87e2f86f9c9ff1e8719e110e43d655a1b0dcbc60dee3f42bc665a0a5947965
-
SHA512
68c3d1d61b29633c0e42875152af7d92bbc92da4c6c7fc666d65b0cd6bead760e5c2a9d2b9f5202f60b017fc9877a83b0d57e12b660b5aa68571fd333a936178
-
SSDEEP
49152:b02ALmXKvHIvuf8/Ucd34uFbs3PlSwfLAjemYWhL0Dd:jALmsI2f814KofkwfLwemT+
Malware Config
Extracted
cerberus
http://ashotiksvagonian.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ocean.size1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5a825df98785ad6f50ac89df74cae8a73
SHA1a44f99a9d3655571921bb82bfbc2f6f650900aba
SHA2569fa54f380c1a74a674b278c86d411684f821b1933e96d55db01eed2fd68fdf3e
SHA512b2ddea5cb2eb16655d62d6f3e7e8a91c0030ed0d4094c1ca8352193cb525e2e21c2ad64c847780a997795bc5d6ae85a1430c5ec5baf1e5bbbbf59ed535d97927
-
Filesize
64KB
MD5f15721b0ca2f2f54658b41d06974b131
SHA17a4ce6a8b8487a9b4fb3e16d45fc718f46e32ec5
SHA2566b898243ced9b13615912db088b6fd0d9286004814b4ed623a223aaf422fbb66
SHA5120acb6f02792202dd8461adfaba185ef274a3d8e3f1989407137278e290de1ecb6f9a40b3ae0e09e21c1ca506c154e87ee4c35b5e0102575b6a42a1f4b353e6fe
-
Filesize
117KB
MD559176bb00f9315c721bc573c89b0ef8d
SHA10fe6fd13ba98b0cc782c9a40ae1f3315bc793104
SHA2564476c4835080feedf92444c38b21e8d19496c3fbe6f46fbc3008b33d4d72686b
SHA51284d7fdb3523bd6c850c8653676fd20e0bdf396fb7134d3118665d84783dd5b6ce2116866957751373424b8ed01ac6e87a1b5b696680ca51434f3ec455b5f67e0
-
Filesize
154B
MD51c7cf555c4564ed756e74e24f9a4cc04
SHA194a134b58cd78dbee4b3d324aa620b8ea23d1fdb
SHA256d529dce7aabed2e93a17159e6696943bfc1f0f3f990a81e02a243a2a65e36680
SHA5124b1bbb00c695a241affafba8893cd182ffe8df63e11283b0646351161c7a043fb10417b72684d872a8b08844b9565b24c3255250d145c1bfeef2f31ea0cd767a