Analysis
-
max time kernel
40s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
13-11-2024 22:10
General
-
Target
38f2bddcbc5c64f413e2a8b4c06cd5a44a7c5256c40b841cb0627985fde5ba73.apk
-
Size
2.3MB
-
MD5
73783757dff0a93cd88b2b188eab81ed
-
SHA1
8882b08b449a61b7d2b9b3d39408176774fa9789
-
SHA256
38f2bddcbc5c64f413e2a8b4c06cd5a44a7c5256c40b841cb0627985fde5ba73
-
SHA512
872cb60c159f5d8e58afa07f49974146f7846d06a7d1153eb886ac4c62fbc1484628b01a0a3a639ffad8d651d9070f25a3ce3e3ba5a8f74067e32d7fa95f7132
-
SSDEEP
49152:5wJXUA7Cj/Ta3ahqSXVEtKdlfGHRVEoOEe8ZqSbcXtk3X0grbbTW8NvfLVbojBUi:y7c/2K9XVEtEGRaVEFqSg9Wk6/WyfLVM
Malware Config
Extracted
cerberus
http://5.199.161.14
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.jelly.shuffle1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD583af8d8cd109cd33b368a062835b5fb4
SHA19543b359cdf0f72cdf52ee33d842bb37fce5a3ae
SHA2563819a23e4fb63ca6ce377ed98df4bbd0fe287096e610c42c310952953e85fccc
SHA5123fe1d8a13215e57d27315ecede481a999a3a60d79e011385a534e11c9f05b5766b25f4ef4d192b5347c1b41d03214968c10e20a069b88151cabf1ef265396cac
-
Filesize
64KB
MD50915a5b6b9d86fbe94452b76a73fb4b1
SHA1328ee251d58443f8c456b10636e53c659d2c1908
SHA2567c0e3f06f821a214ce6542787ba5a59504e6a45534b0fc325b0d7a8015a0dc01
SHA512b9570906a7b672adfe137c74dafb8e32f15381772cba3a87b47f36e03ead77dce9bda0526f6e2cab2b50badedf6ba4dfa00389c2b0fabc39ad7bf71a3564569f
-
Filesize
124KB
MD5ffdadcc65d6859956da6dd0e850b5974
SHA1d99cfcc71e4683adfe36626708430ce43a7ff1ff
SHA2564e2e2e6272ada0442c60cfbbf560c82b05882c0fd6324c5bdf78c31740c15aa3
SHA5127e1568504ef27961ce7541e11dcc9e6e518bed06f55c3318ef02797459c2f0124f34b276e8bc4422c0d8c319b323acd4ba40d09261143ea96b98b66c05f115cf