Overview

overview

10

Static

static

6

8beae1f6b2...e4.apk

android-9-x86

10

8beae1f6b2...e4.apk

android-10-x64

10

8beae1f6b2...e4.apk

android-11-x64

10

Analysis

  • max time kernel
    61s
  • max time network
    83s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    02-10-2024 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8beae1f6b21cec17eed82fb7af25e1782d5b7bf10fd22369603313f1b1a5e5e4.apk

  • Size

    1.8MB

  • MD5

    66dc3fbbc9a6431e58f478a4449b0d83

  • SHA1

    bf965a9e54e8dc95360bc6041d50a5be139903ad

  • SHA256

    8beae1f6b21cec17eed82fb7af25e1782d5b7bf10fd22369603313f1b1a5e5e4

  • SHA512

    f91f8dfce5ff1ed19befc450ffaf13cc69cac40e1efcf8774e28cd3ea3f176fadfe82f219a87824a0e42b8abca59706844338a420283679518f718dcfcea5f1d

  • SSDEEP

    49152:c+cWPEW4PWYbpGURpjx70J0801o33T5/iPcl1dIpkJHRn55F:c+c7XtGULx05/GMT5F

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.cave.series
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4243
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cave.series/app_DynamicOptDex/OEU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.cave.series/app_DynamicOptDex/oat/x86/OEU.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4268

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cave.series/app_DynamicOptDex/OEU.json
    Filesize

    53KB

    MD5

    5306e3e57c51fc8ea6e8d4cff5db2925

    SHA1

    ab780b4483aac68173a386ece2747f5d96ac10bb

    SHA256

    65570ae42c8fa9b5a2688c79f5d070cb5cfa681e0cbc599e962bb8ac7dc94a5e

    SHA512

    deb903799c0cd9ec758b510ef86fe0ac010b414e35ec7b2f02f03f7ca5ee3a25c593fc9b9457a318f68fca254c5e83c35d927560c07826e847e268eca55d38c8

    Download Submit

  • /data/data/com.cave.series/app_DynamicOptDex/OEU.json
    Filesize

    53KB

    MD5

    0a736eca9e643bcedd5f3ec87075e3b2

    SHA1

    09e528cae153f3cddf1f9aaca8d34cfd3dc7e7fb

    SHA256

    ed4c3834db701d9e86d9f85c123208ec30d58b113d074d6f060ac856ac80a314

    SHA512

    3486f79316c149b2c9d0374e41ab03a29d8e9087d4c28306ef053e6551c08e6c3a08136b6e018dbda3c6d34936d535970ff8203537d7ed6486cfdac5b934fd41

    Download Submit

  • /data/data/com.cave.series/app_DynamicOptDex/oat/OEU.json.cur.prof
    Filesize

    822B

    MD5

    0c7485f133ee3d8635fd98cb8ec5b552

    SHA1

    1acd645e235aa3ec6fe81c48f379bd359440bf42

    SHA256

    7c096435be6cd3fe142f7d383621fb063881f2d8be5fb5ef8e7cafc30a7f8d29

    SHA512

    556b3a0289793895ebbffdd3c4c0dcd536d6f0f3d1e332885134003f6901054710474cf53d1e233a25be99525d34752f9540f90db3029a3a45acc480b23949c3

    Download Submit

  • /data/user/0/com.cave.series/app_DynamicOptDex/OEU.json
    Filesize

    103KB

    MD5

    093fc3cdc3fc30cf44b8de258fd5c2e4

    SHA1

    8b63525622acf8fc8506f4a88fef2ea75bcd685f

    SHA256

    21fe1dbf016712ada54e7aa24b64223cc9b9769f96946876c64b0f016d877a5b

    SHA512

    862cb8225dbe55bd204e43101cb5c647e0cfd58feb81f179a92abef7ecc286ece71576fe76bc72e0a1cf36ccf01ff30b1d1600497313bf211ed2a55b58c24d1e

    Download Submit

  • /data/user/0/com.cave.series/app_DynamicOptDex/OEU.json
    Filesize

    103KB

    MD5

    f407beaa04e91aa1b97c4902faba9490

    SHA1

    c803c59843de1a254adbed178fdc83e466e78f9f

    SHA256

    dfd67fc60c62576e6d5f515d302317e99090608a481ed6a558a7503d3c1be6a6

    SHA512

    5b0aa756e2cd802250ef0e119ebf429db86490010d1bb51d7b5bea92478f9a82df2d6658b809ed8ed2a4d6faab0e840135de02e317977496012377f56f6fdcc0

    Download Submit