Analysis
-
max time kernel
59s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
11-10-2024 22:09
General
-
Target
83b24327c6d1fdce830345b36c8e983bee2bbdf734d6395d4220b050fca94120.apk
-
Size
1.8MB
-
MD5
2c2dac12feca946ef3f3f0c9536d7866
-
SHA1
ae33c2dba4e3b7033c325107d6a10d5c9f550ae2
-
SHA256
83b24327c6d1fdce830345b36c8e983bee2bbdf734d6395d4220b050fca94120
-
SHA512
25b3f9aa594fb0ddc5f29daf3f7352c385fbbd676a6c611e978b693cfb647bd56101de4313d38cde5c535e238beb0cf23beae2f2be1477d524354b9b944408fe
-
SSDEEP
49152:3e3BJWJSxsecCfMk/R36uF/52ePLqQAem2WhLZL:3e35NfMkB6K8ePLUemlb
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.modify.clinic1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5d02436405b3e88d90f62a4e9fb94b537
SHA1abbc745379f78a621f69f2ef531aa5211664c072
SHA256d551347e35b6ca41b453b1f1fdab5b742a2b6636a782cc4226b59e78a48776e8
SHA512595bd1d0630c575a883ea9864d729682dfc5452d6956e2b493c5917d76f53d3cd43d57c27622d5b67b653d5698ce8c3a54e2dff3d123c64bc069b23b03840a17
-
Filesize
35KB
MD5f2e311b250c30021b39d9fa37c4c4453
SHA1dec097946f8fedfc381352772e81d777fbd3923d
SHA256c5cdc451280f786151fb9010c7f509993705cc60ca664bfdcb007ca37a5e7114
SHA5127c17117a3bbc7785b63bb0a027fd8f3dfa32f596cb117e94a79e5ae7b600d17b4eb07405d692fe60860725107e20b4d25fea1b3fe34b146de0288bad335263fb
-
Filesize
179B
MD539df1a42972f22ee0a314415e23902d9
SHA1bac44da664dad769240460ce17d07601d7586d1c
SHA25695fa92f7a6b2ecf0f017065b6d14ca402d6ccad859b44cf4d7d243f7e29a2598
SHA512b8b8c80689fd0bbe4e1a0654e5bbd5ae71b9c307ae3ce6b500c50ffb3be5683d7760f29f44cefb96daeecd9a02360e2f0a7ea3cdb8cd5ec3ef8db85a79465bd3
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe