Overview

overview

10

Static

static

6

59f7f18ddb...5e.apk

android-9-x86

10

59f7f18ddb...5e.apk

android-10-x64

10

59f7f18ddb...5e.apk

android-11-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    17-10-2024 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59f7f18ddb4e625024b726457fda42804431937d9e3419d501309e582fa73f5e.apk

  • Size

    1.1MB

  • MD5

    94ce75f38300e5d4506e3ad1d4410027

  • SHA1

    dd6af50b87d0fb8f738697026db7dd56a22c6342

  • SHA256

    59f7f18ddb4e625024b726457fda42804431937d9e3419d501309e582fa73f5e

  • SHA512

    c64f14b6f54d38224fae6a98ba2e2f813bcde388e3a28ff6318f664c05bb7143da5c77c5f6e263724f6f2850d42e3148253eec1d37eea876457565c138bfec35

  • SSDEEP

    24576:RAtpsQXe4K0EMvFInQAmqpv7RvCvYLT49jzhdEQi2Zvxzr:RAtbe50EMvWQAmqpv70v8Tmd6Qi2xxzr

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://kaanworldmotorscamping.ga

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.nerve.alter
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4269
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.nerve.alter/app_DynamicOptDex/oat/x86/sZdr.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4295

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nerve.alter/app_DynamicOptDex/oat/sZdr.json.cur.prof
    Filesize

    822B

    MD5

    f93309d7867139d6cdfe12cf8adc6b91

    SHA1

    1444dbf7eea92d520c1c3f08c2b347a9caeb799b

    SHA256

    652b6a35bb5059515790ce6510c359ffd000c9de4325cdffa53b0e76e6cefd7f

    SHA512

    d9ad37de5d2fa83db690e835d5f8c59d55a7fba22b11e380bc99f67aaa1d3632f7c6f49758e5c5f4de9b39841fa161404c0a3fe375754fc0e182a9a60bf4e5cf

    Download Submit

  • /data/data/com.nerve.alter/app_DynamicOptDex/sZdr.json
    Filesize

    54KB

    MD5

    b5c1d7446d937d10038380e1e30ac2b3

    SHA1

    dc1eece3b43c53cc337a736c814e1ac95f141d62

    SHA256

    e6dcc0fc4c02517d995ad3e61cdfc1a007747ac18613064e042525bef6f61443

    SHA512

    01b78bbb834067f503ac3449ea16e08b60f09fdeaf340a3f906b5b346ef5add83d5e86ac60313f05dcc21a4e81d686835fda48e8786a81baa46876dc16485886

    Download Submit

  • /data/data/com.nerve.alter/app_DynamicOptDex/sZdr.json
    Filesize

    54KB

    MD5

    ca8efeaeea912569c7afcdbdc6a9988a

    SHA1

    2934c218596739578ffdcf994c154c5f0da687a9

    SHA256

    0440ed52d8bbacd195d1f4f5fe696cec2c7ab63d400961dcc8c4ed3c3bf724bc

    SHA512

    5b271982933fd732a97af8bea22337df3f60d8b85c0140c64e1010ca770c27c21e9d6f9751bfcd7cb15aa6b69dc2afe0612683c7e3e9c1542c972c6285708e89

    Download Submit

  • /data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json
    Filesize

    103KB

    MD5

    224a2c45b99e300d00d8e9de8f878342

    SHA1

    41479ed9de22204562d7c86267a94f5698ccc439

    SHA256

    3edb2be642c2fa98f23eac66d7563300114a6daef7d5285a458ca05fd5c1ef1d

    SHA512

    70d786b990d8964f497b6d01704d9621acbf4c8dc78c4d9d8a4049ddbece841fc8484ea8e32bfbb46e55bf219d4d5c61de9171abcaebbf13cf0ce0cde2e1ae59

    Download Submit

  • /data/user/0/com.nerve.alter/app_DynamicOptDex/sZdr.json
    Filesize

    103KB

    MD5

    1f63ca682468f83d0a3451b4e32a9ffd

    SHA1

    4e98cd15b2cb9ef7632d475b297f12cb7a1f0671

    SHA256

    63f4d892a9e1fcf1211d929e2e1a5ab4e9956f1cc1c9fcb4d87761d5cd3494cc

    SHA512

    1ab5a3307e5c85fb343d70224cccc22d9a9cf51fe083874d9f700468fa7aaed3a6c2d6025c0c8305ff92a025bfe038baca66c4cc6732fa16bce0b44060cdcabb

    Download Submit