Overview

overview

10

Static

static

6

05bf42e26c...0b.apk

android-9-x86

10

05bf42e26c...0b.apk

android-10-x64

10

05bf42e26c...0b.apk

android-11-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    16-10-2024 22:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05bf42e26c39ee57b913a38f6999a50c5d48771a23a5fce349a776e5b050eb0b.apk

  • Size

    1.9MB

  • MD5

    9de9f04f89f07dbe06b16e9c850afbf9

  • SHA1

    44b9db445d0e95528abf75de809b6da19f9f8116

  • SHA256

    05bf42e26c39ee57b913a38f6999a50c5d48771a23a5fce349a776e5b050eb0b

  • SHA512

    dcdc8b359507eb35de08e459e1da7ecd5d62071bbf5d01681734715b47cb1cabaaa7ef63030718ba1d374af2696380f68f6cc272b504e2b1dbec9ea004dbb71f

  • SSDEEP

    49152:ZAJ9EIXeRHt0ZsFCpw1CfdirCH9+5A+LrUBvs9D:Z+/mHWMCpw1ClimH9+SBvU

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://5.75.176.47

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ranch.aspect
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4265
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ranch.aspect/app_DynamicOptDex/omwKRlR.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ranch.aspect/app_DynamicOptDex/oat/x86/omwKRlR.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4291

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ranch.aspect/app_DynamicOptDex/oat/omwKRlR.json.cur.prof
    Filesize

    754B

    MD5

    66643103fff89ba2b23e4548e7947d9b

    SHA1

    aa6ff3ab0d8774c04325b4ba09c37b61fd715dee

    SHA256

    339d45a3dac5e3e9fdf121bcec2083c060c00eec40af61d370ece327f6836f94

    SHA512

    b58872b6cb8e59833f90f09035a2dc26161806d9f189bef3055a8ca8e9ae10c35652a61ad506f37a39bbd980050d97454151ecf0a89d15fda3040d515b4fae19

    Download Submit

  • /data/data/com.ranch.aspect/app_DynamicOptDex/omwKRlR.json
    Filesize

    53KB

    MD5

    00a0a2c410445a2d43071b6363ba8a3f

    SHA1

    b0128336b62b685e5dee2dd4afb25ef9b25740ca

    SHA256

    4774e23e25174fd510fa3c0237013dc9a9be092527af189d60255ef98714318e

    SHA512

    63c9c9c3c5024ea4c10080f74f7d51bcb44f1f6902e027b9008b0fedd64c7345b4e9def1a8d5c131347c7f6a7b4185b950753b436bf05b1bdf78bda0ad3d349a

    Download Submit

  • /data/data/com.ranch.aspect/app_DynamicOptDex/omwKRlR.json
    Filesize

    53KB

    MD5

    e2d3d58c13ab3ddc9629bc0b0a6bbbdf

    SHA1

    92159df169fe99333dc1ae9e0501c9c7e19f20fa

    SHA256

    c9ecca7c93091a4e8101963235f8cf5ca0f15d0a0d85263e78e3f18332452b82

    SHA512

    e730b1ed5357824617c27b91affcf8cea149cb2363d4b941b25d909894e2d6a192c968bdec768f4dd92dd86020dd26f9ad790dda9a1121e2f6649c4f6240bb9f

    Download Submit

  • /data/user/0/com.ranch.aspect/app_DynamicOptDex/omwKRlR.json
    Filesize

    103KB

    MD5

    6794feea66967761668fd7ae8a352ad1

    SHA1

    9219d0ad29a8625f4008590c02a65cf86f9aed0f

    SHA256

    c88cb41ceae0a846fb6a2800944cb99d2e1bec064864de118bee20aacc8cc702

    SHA512

    9bf3972c3266ade240dc65ac5e7b27d8317026d83ccc1f3ecef856bb56be3b79f6ec83026c2bded055b011103264b0805c421b0e642b5ad73707a80c178f5186

    Download Submit

  • /data/user/0/com.ranch.aspect/app_DynamicOptDex/omwKRlR.json
    Filesize

    103KB

    MD5

    6ff66eef1acd43b228ea0f264a17829a

    SHA1

    1b76e15249c3b4e47b798453aa6077ca0e9a531b

    SHA256

    b2ca9b4cc973331b2f4ad0d8689a6f0239514dfece0ab2cd43f3d1656d96909a

    SHA512

    1f2d5996e39a26cc2b7f8755143cf5dbcb7127acb5e28073dacde597475473ad476f8f97d46d984fd22063f66aea17f05b9419af6cb74f88f27c0a77e8cefa18

    Download Submit