Analysis
-
max time kernel
59s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
13-11-2024 22:09
Static task
static1
Behavioral task
behavioral1
Sample
09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad.apk
-
Size
2.4MB
-
MD5
62b11627f1b383118a79313228f85471
-
SHA1
cce3926262eee9e7c46622a6874459547f9692f2
-
SHA256
09531cce222b0123140ff842e428cd700b3cc02d0a893101ab24c0cbe4fcf9ad
-
SHA512
bb76e0ad7829252594d311c11306e7a7671dd0367b588a1148cda7d74e701e0fc75acac4dbe91c09d82dfcfd27a2258f85c53d8b3b24d2a03300a90ec3b321af
-
SSDEEP
49152:wqcWdaGD6tkCH6S7SBaBloBZKRcHsBfTEJP8QPC:Fc/GD6t1J2QBloBZKxBfTQPC
Malware Config
Extracted
cerberus
http://94.131.11.56/
Signatures
-
Cerberus family
-
pid Process 4467 com.lgmhwludz.qasqggshz 4467 com.lgmhwludz.qasqggshz -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.lgmhwludz.qasqggshz/app_app_dex/mntcpjh.deh 4467 com.lgmhwludz.qasqggshz /data/user/0/com.lgmhwludz.qasqggshz/app_app_dex/mntcpjh.deh 4467 com.lgmhwludz.qasqggshz /data/user/0/com.lgmhwludz.qasqggshz/app_app_dex/mntcpjh.deh (deleted) 4467 com.lgmhwludz.qasqggshz /data/user/0/com.lgmhwludz.qasqggshz/app_app_dex/mntcpjh.deh (deleted) 4467 com.lgmhwludz.qasqggshz -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.lgmhwludz.qasqggshz Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.lgmhwludz.qasqggshz Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.lgmhwludz.qasqggshz -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.lgmhwludz.qasqggshz -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.lgmhwludz.qasqggshz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.lgmhwludz.qasqggshz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.lgmhwludz.qasqggshz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.lgmhwludz.qasqggshz -
Requests changing the default SMS application. 2 TTPs 1 IoCs
description ioc Process Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT com.lgmhwludz.qasqggshz -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.lgmhwludz.qasqggshz -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.lgmhwludz.qasqggshz -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.lgmhwludz.qasqggshz -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.lgmhwludz.qasqggshz
Processes
-
com.lgmhwludz.qasqggshz1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4467
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5c898b5116ce82522949dd48b1f99984e
SHA19cd81919a3ac9ec9ee9a4e7dabb7febb755606c3
SHA256406fb410d0234a655615ce80e60fc6bf4ddbb60f83e5e1ab1feab397d40bd2d8
SHA5125eea8dab4a21b352de47999eb2595292e431894471e048055d284bb1a165b47b99677d84e9e3633cfd25e6d5df71ee3b30ab0b3fd0d1490980712ae71caef8dc
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f