Overview

overview

10

Static

static

6

a78eb5e015...81.apk

android-9-x86

10

a78eb5e015...81.apk

android-10-x64

10

a78eb5e015...81.apk

android-11-x64

Analysis

  • max time kernel
    67s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22-10-2024 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81.apk

  • Size

    1.7MB

  • MD5

    7dd252bc7eb5a0f4af362b30a225b5ed

  • SHA1

    e84bf0c991a22e3dff64231dc1508eeb9d1cbbf9

  • SHA256

    a78eb5e01531b42d8380be1d6a507f10610c95557716bb2173b331f80e7d2d81

  • SHA512

    1342e015fc81da1fe16dd0fd32bdba6919517053fdcc45e4857fb85f9d827b040d96a2c3d3c02581a10e2db3b9a0b6d51aa7f233a5ed61474f18f9493c517841

  • SSDEEP

    49152:uUahGKVUaBL2zClijxscjgVunVrgyk/9ygYmhFuONYIc2biMQ7:uUaAKVUaBLfglgExgx9/1hFuONU2biM0

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://162.55.21.189

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.share.seed
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4248
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4273

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    e55668923d7c9aec5e9e52268f37b14d

    SHA1

    0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

    SHA256

    b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

    SHA512

    ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    decebb743a92fe0a0acfdeca968c5d6c

    SHA1

    d32c12030a200b5caf85a07c09dc063ad5431d44

    SHA256

    a92ea079b1602ca7a43ca2048e16475c2832a1b9b98c9602d30779aff6fb3981

    SHA512

    434557959be34d19c1c0b28a74d55c75aa44e97bab79fb55c03f66d29ae1856e78395976c27af6f3c1f4bf972753ab950339877ab7bb9c59cbfef4d77f2ad261

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof
    Filesize

    830B

    MD5

    3c6622d6f12770496c21ecb80da58ba7

    SHA1

    d6b11dfee3142f0bbcb158e7744b79098536c06e

    SHA256

    747d296f8ff3e61c1a63dd2e5a3c4a6445ad819b5618950e6da70b0d83adc983

    SHA512

    408552cd85aa05efcd31dc6c1eeeddbcc6c75daec5874b8960fd4ed17fea5d05312f86c18e48015fcf7d3716092620c4786481e8743f607f346d382a589d1bdc

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    02d0a7ebb9a9e83f1ff75fcd631bea91

    SHA1

    4227f46b3c07a93b585a19fa1b5294ea616abcd6

    SHA256

    086694c946a8b7407e34734d221148f1c52fe9d0e5a0d680c707a586427c4852

    SHA512

    3554ba5cdee20b4a252d43ec45540a177c7f5bfdf0febc0c2abe1d48450a0284fe2108a0392765f524840572824a15642fd6c5aeef3221ec16938835651047f5

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    bf3a8b20950af2241e402aa6c819bcbf

    SHA1

    fbe7196d34d9fff857087a88a95df291b02e52c1

    SHA256

    307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

    SHA512

    68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

    Download Submit