Overview

overview

10

Static

static

6

09e143ba2f...08.apk

android-9-x86

10

09e143ba2f...08.apk

android-10-x64

10

09e143ba2f...08.apk

android-11-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    153s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    05-11-2024 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    09e143ba2fce1eb3516b8bef4cf557f9b8555a23f17c291b414d3011c625c608.apk

  • Size

    2.2MB

  • MD5

    8db20fdd6a1351fc6af195f00726630e

  • SHA1

    04d67a93b92feaee57f237305175435651b9a254

  • SHA256

    09e143ba2fce1eb3516b8bef4cf557f9b8555a23f17c291b414d3011c625c608

  • SHA512

    a7e16149df32d0c09765fb84ff5353f997c16e68c12644dd6229c65131ba90b340290bd2f53c93dabd9acdd0686e1908cee668b4e8ac14a3ccd92ac694cbdb8a

  • SSDEEP

    49152:sd8ChyQH7uhszAbpiXoEbgFlFGLVhoUEe8ZqSbcRtk3X0g3bbTWyrvjLfbUj5UZ7:sNhuhLbYXoEbai7DEFqSgbWkC/W2jLf3

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.bonus.dove
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4336
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bonus.dove/app_DynamicOptDex/mOSk.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.bonus.dove/app_DynamicOptDex/oat/x86/mOSk.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4362

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.bonus.dove/app_DynamicOptDex/mOSk.json
    Filesize

    53KB

    MD5

    990f1924eb218990eea626c2ad1c22d7

    SHA1

    0b4e6699e1f345e77e22bebf0b7ed35870129030

    SHA256

    f5b2b06288661e50485a3d1f0eb27278578b21aea2a7698ce48724dc8c859354

    SHA512

    97eb500f0122d573c4d5bd584c4913692b8232734a1e204434fe612906aff906a3dda5f6112603919e8738ed78184f94465169bb6704511fbc34faeeabf5b5f9

    Download Submit

  • /data/data/com.bonus.dove/app_DynamicOptDex/mOSk.json
    Filesize

    53KB

    MD5

    b937d19f777ca14c5850e5a817cc13a7

    SHA1

    15ddc415fcf0207293991cd68cc83f73af0c5747

    SHA256

    9fc711a3a35d0e0d9a4ab4eea7f62183712947707132a735c5216d6b64965946

    SHA512

    b90d4a8d1f1aa932f550b0dccec2bfa74142a6834a7a83fafcd99be4d5f0b9e8c33ed87e68f42b922ce9318fa8e95820f7f1ff2b6864f31807e64831ca46d4f1

    Download Submit

  • /data/data/com.bonus.dove/app_DynamicOptDex/oat/mOSk.json.cur.prof
    Filesize

    817B

    MD5

    95a1e2958beba2d0b51897a0d3ffe63d

    SHA1

    22b72b6c2abf0a3ed216a690548c994f467ca1cc

    SHA256

    8e4b56a94d141c41879e18d7017716719464e15d7415294dc9e537787999f57b

    SHA512

    788e2a646acaef094b186beadda972ac185324ab74eecac2def07ed0472ea0af65bcc0a6f1b33ea6bffde079313cce6ca181b2d12770aeee899c0a77809c0135

    Download Submit

  • /data/user/0/com.bonus.dove/app_DynamicOptDex/mOSk.json
    Filesize

    103KB

    MD5

    a688d04b3ae011c3e58aea1f3c697427

    SHA1

    2bb03a235f292436a9595c216302e6803f078042

    SHA256

    d3ba46b5f1ac8086e1c57d49d720e4e589752e3f243503a4b4cc7e4b1935651e

    SHA512

    1632f54271c26eadc2a860eaa4f197662e5a4d39f2c4ff0aeedd9cc46a68a9e02f71db2d0316024506f43be9b23256dce2d21552323ea397f5b0f069b65ed446

    Download Submit

  • /data/user/0/com.bonus.dove/app_DynamicOptDex/mOSk.json
    Filesize

    103KB

    MD5

    65642efb80551c5206345255b7506413

    SHA1

    adfad04747dca576d93bbb799fff57f8db24824e

    SHA256

    e0b4d86ab41bf1603bc8d364bf96abb3e534f2eb5ec95d2dd1ad292089cab61a

    SHA512

    677963c8fc4fa5a136b1caa5419572e35adf03584842226632a3fe0472a321d11aa127ffffa51a36a8b3be1d289010be77f683fca4bf9d1f706be27f3369bb56

    Download Submit