Resubmissions

09-11-2024 01:30

241109-bwtfqathrc 10

08-11-2024 23:26

241108-3exwcsvmbk 10

General

  • Target

    7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.bin

  • Size

    1.9MB

  • Sample

    241109-bwtfqathrc

  • MD5

    8f582084127a364695aa007925f74065

  • SHA1

    62a27bbacee4314e3fbf99777f3be0eb4c30b158

  • SHA256

    7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889

  • SHA512

    79b718cddecb321eee1464d54a32398690acc92c88faf0dec2a44fe23dce606382fdf033b3542c913ccd35174a78ffd466b246a38e4da0505da91ef8f3957d08

  • SSDEEP

    49152:D68Y3e+Cj1Z9KoKndF0KP0J0801fjSRZg/60dmcl1dIpkJgRh5HH:D68b+IZKbjSM60CMeHH

Malware Config

Extracted

Family

cerberus

C2

http://mtrfff.ru/

Targets

    • Target

      7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.bin

    • Size

      1.9MB

    • MD5

      8f582084127a364695aa007925f74065

    • SHA1

      62a27bbacee4314e3fbf99777f3be0eb4c30b158

    • SHA256

      7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889

    • SHA512

      79b718cddecb321eee1464d54a32398690acc92c88faf0dec2a44fe23dce606382fdf033b3542c913ccd35174a78ffd466b246a38e4da0505da91ef8f3957d08

    • SSDEEP

      49152:D68Y3e+Cj1Z9KoKndF0KP0J0801fjSRZg/60dmcl1dIpkJgRh5HH:D68b+IZKbjSM60CMeHH

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Cerberus family

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the phone number (MSISDN for GSM devices)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests changing the default SMS application.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests enabling of the accessibility settings.

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks