Analysis

  • max time kernel
    56s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    11-11-2024 22:00

General

  • Target

    878ea6769a0a95fe62c0041069db6f97fa29d29cb9fbb4adc345ea5e0cd077eb.apk

  • Size

    1.9MB

  • MD5

    d836325c640b4ffb3ccd12734ed567ba

  • SHA1

    97d5b8e7d149c5c3133a87c642c9dc80cb356e26

  • SHA256

    878ea6769a0a95fe62c0041069db6f97fa29d29cb9fbb4adc345ea5e0cd077eb

  • SHA512

    da4ac92a75c8f6e75ab3a153ddfd73c8f0a748e432ab1ca0d9858c6739077fd84fce8c4aa4e0636d94abc940bd41c9bfc43ea054956908120e6820efbeaddb9f

  • SSDEEP

    49152:nvXpvTyX05l4QNU4xnMeQ0J0801R5gLGGLJmcl1dIpkJAR95bXDg:vXxTyX0kiUW/GGLaM+bc

Malware Config

Extracted

Family

cerberus

C2

http://petsapps.ru/

Signatures

Processes

  • com.across.load
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4955

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.across.load/app_DynamicOptDex/nAQ.json

    Filesize

    64KB

    MD5

    f7676008c73ecdff34a49dbbf70ff3c9

    SHA1

    0c6eef12a3e26e1815b122a0a6a2fc76efcffe6d

    SHA256

    063d8e9a718b3a6cf077f9828bd211a4dbf186b89c849f02bd0ddb7583b4b381

    SHA512

    036f56cc42e8855a64ed8d036397a19697e4b3c093253fe1ae4107ef10ebbf3c95170e8f2f26347b097c13d13fbce36d64d02cca3db7e4f382019814f115bd2a

  • /data/data/com.across.load/app_DynamicOptDex/nAQ.json

    Filesize

    64KB

    MD5

    f030e6177b5cb7748d676b3facf9564d

    SHA1

    d1848e922632e7dcd87b0d1d70ff5af6b158ff2a

    SHA256

    3d015fbe3687ab0c5d3d2546b971be522c7071f3d872a57e3e767bb2c0f4d853

    SHA512

    a184ec3cc70d1131ab81bb71dd565de56d7f85973cc77d3cc0645ee5dc946bba4d8d864f8f80cfb930c5ba7da5d6decbbc0a00de961bd39c1a37e175fc6d070d

  • /data/data/com.across.load/app_DynamicOptDex/oat/nAQ.json.cur.prof

    Filesize

    210B

    MD5

    23d54126ec5f7e96ebb283c19ac48fd2

    SHA1

    b985bc04a1d979ff8ff10661e2bdb417af95d592

    SHA256

    5834eaa30cc2ab89e61fb73aeae3900b42c765d513e7bd4cfd7a89238da9eb90

    SHA512

    c4b0ffd102ba25d2a319787ded54819a3b9e6cdafe5008d1742042c6638489cf97a24c04fb730771e6fba9cf4ad5349e0b80444694d2dd6efed99e924ae45830

  • /data/user/0/com.across.load/app_DynamicOptDex/nAQ.json

    Filesize

    118KB

    MD5

    a71bb5324fc5a2c69fa994fd4408a228

    SHA1

    0bfb0c05127251098d7905aa702bcca3d365770f

    SHA256

    3f4ff666cc0a09a322be4c8af86832f3fa688319d25b32a21353527d81a8691b

    SHA512

    8cdec039b85990457eb47ebb415dc7fdf796bf1b14d9a81480941e9237f40f8dfefb2e40fc28c580a463b22612a8dd67bb8b40db6f7b5180fc129b7f1214b9b0