Overview

overview

10

Static

static

6

f6e613b685...bb.apk

android-9-x86

10

f6e613b685...bb.apk

android-10-x64

10

f6e613b685...bb.apk

android-11-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    28-09-2024 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6e613b68558315b0dee2fabec819a4a3aa2b9422931cf5a67c58bf26ad159bb.apk

  • Size

    1.1MB

  • MD5

    93f7efa494e006bf72dc5011a9b4f20c

  • SHA1

    6543824d42e3aa47d35087955d416bdc059d7911

  • SHA256

    f6e613b68558315b0dee2fabec819a4a3aa2b9422931cf5a67c58bf26ad159bb

  • SHA512

    a9b1d56e19df66671aa930942bf86b411d40ac891d5da496a2c78a39e1f4a5be17fdfc4915cd7d5aa51e8d6b2197d430887224e713ce28499f4a4b8e3060bcc3

  • SSDEEP

    24576:kJF29oN1+Lxhc5vxlgwsPUk0exeAJ/f0esSh08r6G19u+s:XoN1Exhc5vXgwIUXe5/s0rb10v

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://37.27.8.83

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.crunch.awesome
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4373
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.crunch.awesome/app_DynamicOptDex/SI.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.crunch.awesome/app_DynamicOptDex/oat/x86/SI.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4397

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.crunch.awesome/app_DynamicOptDex/SI.json
    Filesize

    53KB

    MD5

    ea07252690c3f24bcf18efabf5a6961d

    SHA1

    0017d3cd96bea3cf0dfc717e42c8bb5f1f502c25

    SHA256

    786a374ebf8506b001414ebd410eecad7c28564da00c875b8a2326740ee0c6b2

    SHA512

    9d834f4f87dd1c73c6660c429a6645150a9251dce91942d79089e30aef21a3bef4d321f867d4e060f6b6731a70e945ef4d422edb7c30f759a111e93195baae4b

    Download Submit

  • /data/data/com.crunch.awesome/app_DynamicOptDex/SI.json
    Filesize

    53KB

    MD5

    fe79aa49e197cea1dc94d2cc568eeeab

    SHA1

    f2c1b2014ce9ee3c7b2347173a6431839c5f3455

    SHA256

    d15eca8b2e5d88c5b332d210878427af723803cb473990c151f4d7825fd3eebe

    SHA512

    4c73b896396d1b401cb91eb849ee71b1231359d46dc2d9246762624bb11f69128e7b98f4aef504de49a9a1681c1a91fece6da4aac2a137372af53737dd0bcde0

    Download Submit

  • /data/data/com.crunch.awesome/app_DynamicOptDex/oat/SI.json.cur.prof
    Filesize

    754B

    MD5

    f45710050f4b08063ea2afd40fbf716e

    SHA1

    48f13590a0831ef62f621d0b51d7e7aed701d53e

    SHA256

    f5185611ad610b6c8fce82c3a183134f2d7c11d1e2d693b9699270d529d6ad0e

    SHA512

    6595cffd13456192a884142497c920d3819d64a2a3a99b0723f2b014d1e7739cf170a4b3d3c9b86af58418dccd4073718d029a89e85d28e81d49b2ebdae968bd

    Download Submit

  • /data/user/0/com.crunch.awesome/app_DynamicOptDex/SI.json
    Filesize

    103KB

    MD5

    e0b3c0a26a542662d25340b33e59ecab

    SHA1

    94639a7c7185cd2aa452f3d07118488ec7ccc7ab

    SHA256

    ed8386733c7220ce4615c783bfa60afe5a155a6352517cd3c0f80703a283124d

    SHA512

    7d4a40cb1d5e1311a896ef2686f406e1020268e8ec68b34b0f0b774d6615b26f45013dfc4c90757047d378775508c6a59674693d6f2d7805d074dedfbf90a463

    Download Submit

  • /data/user/0/com.crunch.awesome/app_DynamicOptDex/SI.json
    Filesize

    103KB

    MD5

    ca7b298ead3e2f3914596ffc89f58283

    SHA1

    5693db2a01e6ee955ed3863047847879f60f29e0

    SHA256

    8cffb693c69373ee9656b06740412e976ca9c0ff9d37a429092a41dc163fe925

    SHA512

    3a4d03a6d6c84c26b29b43dfd677787be7ebabfc7e0363648da6f56b3c3fffc8dedce17a7c67e2cc7c33105d1c2aebc2f1b06630152dcdc0122737fd913aebec

    Download Submit