Analysis

  • max time kernel
    32s
  • max time network
    163s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    05-11-2024 22:04

General

  • Target

    09e143ba2fce1eb3516b8bef4cf557f9b8555a23f17c291b414d3011c625c608.apk

  • Size

    2.2MB

  • MD5

    8db20fdd6a1351fc6af195f00726630e

  • SHA1

    04d67a93b92feaee57f237305175435651b9a254

  • SHA256

    09e143ba2fce1eb3516b8bef4cf557f9b8555a23f17c291b414d3011c625c608

  • SHA512

    a7e16149df32d0c09765fb84ff5353f997c16e68c12644dd6229c65131ba90b340290bd2f53c93dabd9acdd0686e1908cee668b4e8ac14a3ccd92ac694cbdb8a

  • SSDEEP

    49152:sd8ChyQH7uhszAbpiXoEbgFlFGLVhoUEe8ZqSbcRtk3X0g3bbTWyrvjLfbUj5UZ7:sNhuhLbYXoEbai7DEFqSgbWkC/W2jLf3

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

Processes

  • com.bonus.dove
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:5239

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.bonus.dove/app_DynamicOptDex/mOSk.json

    Filesize

    53KB

    MD5

    990f1924eb218990eea626c2ad1c22d7

    SHA1

    0b4e6699e1f345e77e22bebf0b7ed35870129030

    SHA256

    f5b2b06288661e50485a3d1f0eb27278578b21aea2a7698ce48724dc8c859354

    SHA512

    97eb500f0122d573c4d5bd584c4913692b8232734a1e204434fe612906aff906a3dda5f6112603919e8738ed78184f94465169bb6704511fbc34faeeabf5b5f9

  • /data/data/com.bonus.dove/app_DynamicOptDex/mOSk.json

    Filesize

    53KB

    MD5

    b937d19f777ca14c5850e5a817cc13a7

    SHA1

    15ddc415fcf0207293991cd68cc83f73af0c5747

    SHA256

    9fc711a3a35d0e0d9a4ab4eea7f62183712947707132a735c5216d6b64965946

    SHA512

    b90d4a8d1f1aa932f550b0dccec2bfa74142a6834a7a83fafcd99be4d5f0b9e8c33ed87e68f42b922ce9318fa8e95820f7f1ff2b6864f31807e64831ca46d4f1

  • /data/user/0/com.bonus.dove/app_DynamicOptDex/mOSk.json

    Filesize

    103KB

    MD5

    65642efb80551c5206345255b7506413

    SHA1

    adfad04747dca576d93bbb799fff57f8db24824e

    SHA256

    e0b4d86ab41bf1603bc8d364bf96abb3e534f2eb5ec95d2dd1ad292089cab61a

    SHA512

    677963c8fc4fa5a136b1caa5419572e35adf03584842226632a3fe0472a321d11aa127ffffa51a36a8b3be1d289010be77f683fca4bf9d1f706be27f3369bb56