General

  • Target

    09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad.bin

  • Size

    2.4MB

  • Sample

    241113-1286sstmfm

  • MD5

    62b11627f1b383118a79313228f85471

  • SHA1

    cce3926262eee9e7c46622a6874459547f9692f2

  • SHA256

    09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad

  • SHA512

    bb76e0ad7829252594d311c11306e7a7671dd0367b588a1148cda7d74e701e0fc75acac4dbe91c09d82dfcfd27a2258f85c53d8b3b24d2a03300a90ec3b321af

  • SSDEEP

    49152:wqcWdaGD6tkCH6S7SBaBloBZKRcHsBfTEJP8QPC:Fc/GD6t1J2QBloBZKxBfTQPC

Malware Config

Extracted

Family

cerberus

C2

http://94.131.11.56/

Targets

    • Target

      09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad.bin

    • Size

      2.4MB

    • MD5

      62b11627f1b383118a79313228f85471

    • SHA1

      cce3926262eee9e7c46622a6874459547f9692f2

    • SHA256

      09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad

    • SHA512

      bb76e0ad7829252594d311c11306e7a7671dd0367b588a1148cda7d74e701e0fc75acac4dbe91c09d82dfcfd27a2258f85c53d8b3b24d2a03300a90ec3b321af

    • SSDEEP

      49152:wqcWdaGD6tkCH6S7SBaBloBZKRcHsBfTEJP8QPC:Fc/GD6t1J2QBloBZKxBfTQPC

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Cerberus family

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the phone number (MSISDN for GSM devices)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests changing the default SMS application.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks