Analysis
-
max time kernel
57s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
13-11-2024 22:10
General
-
Target
38f2bddcbc5c64f413e2a8b4c06cd5a44a7c5256c40b841cb0627985fde5ba73.apk
-
Size
2.3MB
-
MD5
73783757dff0a93cd88b2b188eab81ed
-
SHA1
8882b08b449a61b7d2b9b3d39408176774fa9789
-
SHA256
38f2bddcbc5c64f413e2a8b4c06cd5a44a7c5256c40b841cb0627985fde5ba73
-
SHA512
872cb60c159f5d8e58afa07f49974146f7846d06a7d1153eb886ac4c62fbc1484628b01a0a3a639ffad8d651d9070f25a3ce3e3ba5a8f74067e32d7fa95f7132
-
SSDEEP
49152:5wJXUA7Cj/Ta3ahqSXVEtKdlfGHRVEoOEe8ZqSbcXtk3X0grbbTW8NvfLVbojBUi:y7c/2K9XVEtEGRaVEFqSg9Wk6/WyfLVM
Malware Config
Extracted
cerberus
http://5.199.161.14
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.jelly.shuffle1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD583af8d8cd109cd33b368a062835b5fb4
SHA19543b359cdf0f72cdf52ee33d842bb37fce5a3ae
SHA2563819a23e4fb63ca6ce377ed98df4bbd0fe287096e610c42c310952953e85fccc
SHA5123fe1d8a13215e57d27315ecede481a999a3a60d79e011385a534e11c9f05b5766b25f4ef4d192b5347c1b41d03214968c10e20a069b88151cabf1ef265396cac
-
Filesize
64KB
MD50915a5b6b9d86fbe94452b76a73fb4b1
SHA1328ee251d58443f8c456b10636e53c659d2c1908
SHA2567c0e3f06f821a214ce6542787ba5a59504e6a45534b0fc325b0d7a8015a0dc01
SHA512b9570906a7b672adfe137c74dafb8e32f15381772cba3a87b47f36e03ead77dce9bda0526f6e2cab2b50badedf6ba4dfa00389c2b0fabc39ad7bf71a3564569f
-
Filesize
214B
MD5a9dab7135a2cd15f4b5801b0d1637630
SHA1e8a845e722fb5b3460ab905e0daa2f2dbf3bddf0
SHA2569633f8958ebd7f9b78191826c70f98cc3e33a6fcce5fe843c516e629966897a6
SHA5122df39d73703a4dd0d1fe2ec1776fe2c1f33e9b3505e1fe3512759170f053138e6279e584619856e0002d1c18733136bd43be86e507a00677de3be0314ccad6d9
-
Filesize
124KB
MD5ffdadcc65d6859956da6dd0e850b5974
SHA1d99cfcc71e4683adfe36626708430ce43a7ff1ff
SHA2564e2e2e6272ada0442c60cfbbf560c82b05882c0fd6324c5bdf78c31740c15aa3
SHA5127e1568504ef27961ce7541e11dcc9e6e518bed06f55c3318ef02797459c2f0124f34b276e8bc4422c0d8c319b323acd4ba40d09261143ea96b98b66c05f115cf