Analysis
-
max time kernel
58s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
21-09-2024 21:59
General
-
Target
buta.apk
-
Size
1.4MB
-
MD5
b9536514d30e4ec921c719dd8755a8b1
-
SHA1
26fb754062696182a2ce8013c48589732a08028f
-
SHA256
f03368a830b3cd77b5897f7735c080599bb4f18dfc7879de9fc951e7b1e1cd5f
-
SHA512
4a83728138453f8ffd11226df8cf58f8c4f12a922561d95f1645e1ccd827e535e56b2d9bfafc21b58b6d4ebff8e206711d76cb484fee95233eb01910e063129d
-
SSDEEP
24576:LLoOqMh1jo1VAT3iJ5xxhlAPl+tFjNFe/FvAFKRRqdfLnYcRSKemQsWhWmdf+:oOqQ1jowSJbDljFNFuFvpYdfLnYateml
Malware Config
Extracted
cerberus
http://80.87.192.227
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ill.news1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5132cb817a6ec5f00c650ab15d811de71
SHA125f626f6fc662b1811c9a8ce4f3f0dea909f9237
SHA256b83566ee784d8a7c1c2322cf2afaee0aa272be867198a5d3fdfed61cfbbf12a6
SHA51292aa710bb991e7359732390b931f91308f7d223a0454907843ad6c146de4d86c57b109e6c53902a3961f3db71ead95c293cb7edb991337feb3189a3f7492276c
-
Filesize
34KB
MD584e0f5c5cad17a23303d1a7c85b3231c
SHA1baed37c8ba485ec89e44e096a21cd57fe9949b17
SHA25646013aff1a9db975d0535cdb7c44f324892658a8dd3df74accb01c5604d5318f
SHA5123d3772b0f97f01d706286af069edfc630c14737bdde181ec26456fe7b943fb22092a3ff336eb6b9b72f0ea06cac8747c2c7b322e549c403a2e7fdcbe00988589
-
Filesize
76KB
MD5262d9655c7d686d31b55aa1976061517
SHA15f6d350e5e6ae66afee5ddddf4aceaf5dcb8899c
SHA256df1baa0be867f09df28532c5078b0c84f1f133e5b33182143f776ae3751779b0
SHA512b660b7636b06b2aff6e4da60346424ba6902a3e247760e211f628b0ad582d36eff04acbba3e600442a0da57449316f458643f49ff34ce82f2cc8dfbe2e8aa16b
-
Filesize
148B
MD58148be9bad6359af1b9fa755aa7058c2
SHA1f3e4456ab519604995b01aba6b80f315b242f1ea
SHA256e34f882080a8251585f279478845afcedc5e2726331aa6fc358f0cdd6c32ed52
SHA512a7531fcda6daa39907b7cddef5b14b5307804473dbd038fff3c76b44a0ce23edbbb91e7d70af8426177bc46ad4df083107ce1a1e63a5332510a859977c780969