Analysis
-
max time kernel
83s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
09-10-2024 22:09
General
-
Target
0047544a2e2cfff38f0e31eae0b5aea1249267abde54dcd68ca28c24a2c2d740.apk
-
Size
1.4MB
-
MD5
34f5b990477aa1bae4bd788757e828bf
-
SHA1
7f36ccc8c6c58beb2aa16d55b3f0c78dfbbfd109
-
SHA256
0047544a2e2cfff38f0e31eae0b5aea1249267abde54dcd68ca28c24a2c2d740
-
SHA512
22dcff691b7d4bfc2346d92a2dc4aa2222b7f30fb589ee601cd851e914864785fb245f12395a5d22592a1129b3116dc23a6700aa0e9eff67a6311fe6c5e171ef
-
SSDEEP
24576:0MhMGTjfKJSFRjSxOAaJlnS3/4rdmbrXa3Kj3D1e0/5ao+mv4RgAl8JS:TeGTjfKw7GwlsP4rdmb26j3wk5ao+uyR
Malware Config
Extracted
cerberus
http://gasvasparas.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ball.surface1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d2075fc813622a75552ee81954e12335
SHA15bf12edb72fb207e0acb4cf9220f21213962666c
SHA256082d468681386a49973d315121118469f2c7492fbc5d9130e8b0dd4a492bc6a7
SHA5127a97055b121393132fdb87dbe0a952dfa7fcec61673a4619747dd0b908350b629c309d51c3f209e984ecfd17afe8ca75ba52c0f85142cee6d1ddd0ba67533d8c
-
Filesize
64KB
MD50fc1573b6e1622b32c3183834d3b5e21
SHA1971fc361600af50824fb3cadf1f3867100189737
SHA25683f92fe25c1b741fce5e97b2ef8845358d5597cfa8421c3e7937cd6f3cd233dc
SHA512b66c39eaebd0e45ed4cf827304934c9b012ba42396e6c3db480406918d9e7a6b9c3a4b2e7dbb3f9b7239a46d305017dcd922b259d3d00ca63b7779b3fac6d7e7
-
Filesize
237B
MD59d475df568c22f3439cbca5074a26a52
SHA123dd2f3d3a99020f3f8432b93582df2158df7596
SHA25622b619223fe959b22e621a0398fc7da6a604fc73d3b2825c75d07f7fe547e4a5
SHA51267b754ca3309cb5341329aadf23c1cda597bfa04e1c9ff62cc90c26756045a17d109a36ebd16fc994e31024aedbcb8fe98e01db7fcdc108defb1844f43791b6b
-
Filesize
118KB
MD586dcd480f7669ca5cd967ce8370efd55
SHA1c34dd08e09744145412c3ff216e4d93c8e10b803
SHA25677249e2a36df750ac5553f183f9263e544fa55f6db1bd19ade95cd890e045243
SHA5121b018a1210460af46694f6015e6bbb57405d936104d65d2cae582aba1a7983f46acf186b87e9725258564e55d7b0c7c75378d97e463d8dab242fd4f8edf5e607