Analysis
-
max time kernel
73s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
09-10-2024 22:09
General
-
Target
480a039a2298ab9b15487ffb40373635520d66566c7cad588db03a81005a32a6.apk
-
Size
1011KB
-
MD5
705733968cc79366bcecffad4a40e369
-
SHA1
f6926c84bd5a846a12de502bb234ef521c3488af
-
SHA256
480a039a2298ab9b15487ffb40373635520d66566c7cad588db03a81005a32a6
-
SHA512
c1d4fc483589b0f6e8b02134a2621e30500d2a54790b9a4234a59b61dd3ae2a8bb52d1663c37968072f12b545ff920d2c86d33e1ec97acec321ae3de21da3eac
-
SSDEEP
24576:LScLrnHiKdTKJr4jRkhq1TBoMYoCryC4w2uShIM1kUv1U1P:LjLiMiroKGYoLCle/hv+d
Malware Config
Extracted
cerberus
http://37.27.8.83
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.joy.best1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD57d875dd5d5141b3349a9687b97f248ad
SHA1c5551d1e4c43145f1e5f66ee7229a38dd91ba1bd
SHA25678c144163ecd60ec91cb375753ad769750686ac762418f3bf50d4d4a5d44025e
SHA512910aaf7c0e3f29fd522b8d8ae6256967080aa073b417d446378a4ca43a71fba0bac9bef81c05ba740ae40a2f9c57fdbc6122ee71fa35333feb58b928a324773d
-
Filesize
54KB
MD58d9183974119190ab0af32152aa165fe
SHA155df6f471ee058c2869ad516a860ee628439a887
SHA256c68173e2a380a4e67c4e8d4978d18d0d34923ecfc4006858ce234da714895384
SHA5125677059fbef3879ad8ab1e43515e1f75771feaf72b910667c6c13c8c087f12d52264267054c8b353a0ccb6c5e6245236f9f45143766eee2f0dd91834b9b71d5e
-
Filesize
161B
MD531001ef78aa8e3b91c5422e58605832d
SHA16ca7baa7742c284c2730ce88cbd25344c1af4c35
SHA256bb07372fe3f665aa015795b05379a57642890fd07b7d139c9762575a3d715fb5
SHA5125fea79dba0a2662ff0d2f30d3b954e434c059809252657dfdeb898ca84fb545c6d183d8fa6f825ba7aefa32843b1b48a5f2a7d6ac216e4c61f09a238f80ca5aa
-
Filesize
103KB
MD5ecd2d48e8aca5ced3fc7084d3de38df4
SHA157fcf6a74bc0d2923952f67546022e1299b88ba0
SHA2564e77f1cebf039cd510bc99893f9a044b7f792bc13961b10a86e31613ad562b55
SHA5126719626fc69b6d024909f237ea08289c9cd1e6edb22a39fc8ff213aa8e82682f72b4c3605b4ebd60bd77c8d416f09eb5db2e9b51553dbc783c2027d9dfa24dd4