Analysis

  • max time kernel
    57s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    02-10-2024 22:06

General

  • Target

    8beae1f6b21cec17eed82fb7af25e1782d5b7bf10fd22369603313f1b1a5e5e4.apk

  • Size

    1.8MB

  • MD5

    66dc3fbbc9a6431e58f478a4449b0d83

  • SHA1

    bf965a9e54e8dc95360bc6041d50a5be139903ad

  • SHA256

    8beae1f6b21cec17eed82fb7af25e1782d5b7bf10fd22369603313f1b1a5e5e4

  • SHA512

    f91f8dfce5ff1ed19befc450ffaf13cc69cac40e1efcf8774e28cd3ea3f176fadfe82f219a87824a0e42b8abca59706844338a420283679518f718dcfcea5f1d

  • SSDEEP

    49152:c+cWPEW4PWYbpGURpjx70J0801o33T5/iPcl1dIpkJHRn55F:c+c7XtGULx05/GMT5F

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

Processes

  • com.cave.series
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4983

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cave.series/app_DynamicOptDex/OEU.json

    Filesize

    53KB

    MD5

    5306e3e57c51fc8ea6e8d4cff5db2925

    SHA1

    ab780b4483aac68173a386ece2747f5d96ac10bb

    SHA256

    65570ae42c8fa9b5a2688c79f5d070cb5cfa681e0cbc599e962bb8ac7dc94a5e

    SHA512

    deb903799c0cd9ec758b510ef86fe0ac010b414e35ec7b2f02f03f7ca5ee3a25c593fc9b9457a318f68fca254c5e83c35d927560c07826e847e268eca55d38c8

  • /data/data/com.cave.series/app_DynamicOptDex/OEU.json

    Filesize

    53KB

    MD5

    0a736eca9e643bcedd5f3ec87075e3b2

    SHA1

    09e528cae153f3cddf1f9aaca8d34cfd3dc7e7fb

    SHA256

    ed4c3834db701d9e86d9f85c123208ec30d58b113d074d6f060ac856ac80a314

    SHA512

    3486f79316c149b2c9d0374e41ab03a29d8e9087d4c28306ef053e6551c08e6c3a08136b6e018dbda3c6d34936d535970ff8203537d7ed6486cfdac5b934fd41

  • /data/data/com.cave.series/app_DynamicOptDex/oat/OEU.json.cur.prof

    Filesize

    827B

    MD5

    a14117f7b62235c14f247135f49545db

    SHA1

    5ba61d80b242a80b435b24a21b8da97148c6478e

    SHA256

    89b946f301a0ad0e8006317e7d149449920dce621c5989e9d92e8534cd7fc6fd

    SHA512

    46bbc032227d281d89c1e16da37374dec7ce2d805e99a9faeeb1bb1446b3a7e4fe187c332b3e7933bb6a7c380aba28c6c1e9a133108bdc6b5f8cac96ad07ba5b

  • /data/user/0/com.cave.series/app_DynamicOptDex/OEU.json

    Filesize

    103KB

    MD5

    f407beaa04e91aa1b97c4902faba9490

    SHA1

    c803c59843de1a254adbed178fdc83e466e78f9f

    SHA256

    dfd67fc60c62576e6d5f515d302317e99090608a481ed6a558a7503d3c1be6a6

    SHA512

    5b0aa756e2cd802250ef0e119ebf429db86490010d1bb51d7b5bea92478f9a82df2d6658b809ed8ed2a4d6faab0e840135de02e317977496012377f56f6fdcc0