Analysis

  • max time kernel
    71s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    14-11-2024 22:03

General

  • Target

    1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.apk

  • Size

    1.8MB

  • MD5

    e7e2f6d3f4dd11eaa700e91c5453c1fb

  • SHA1

    ac4534de63725c1bf08e3eb0d069279e26dfffdb

  • SHA256

    1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b

  • SHA512

    02e3f34a7073ceee74093fdefc2dc8a012e0d0c3d0c5cdc06ef5441ab54765d999a95b922bbe7315a90635f99e49f9b9e0f8331e35697123db5067609bb72db5

  • SSDEEP

    49152:M7/1f6YGBpltmVDLth1DTXuFHE+2TLCBem2WhLHW:M7/IHmVn9TXKP2TLIemlY

Malware Config

Extracted

Family

cerberus

C2

http://94.250.253.26

Signatures

Processes

  • com.amateur.crime
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:5045

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.amateur.crime/app_DynamicOptDex/oat/wdAnr.json.cur.prof

    Filesize

    197B

    MD5

    2dc200502bb70e6a9e25cee9523b7ca8

    SHA1

    40bffb8500502a2874298503b54f47127baa61a4

    SHA256

    2754ef3f01117c517ffc89d7df5368818fc57930b69ac8c5bff1ca1448ddbf42

    SHA512

    f198147121b604972b4f89afa988f4b23894d62bef8c1614d5b9bde56569cca4179c114c4c14fd7ef489c444fcc36377b36bb7b249279a88978bce4d3418ca8b

  • /data/data/com.amateur.crime/app_DynamicOptDex/wdAnr.json

    Filesize

    35KB

    MD5

    8acd55c8b9474bc98cc5a9362f6dcd47

    SHA1

    761fe5911be43bc492c73cfb2e72a73e299bd42b

    SHA256

    b386e93c90096f70f16d66efb62a3b4196cc5e15f8aa7313eef5e9d74ae82e9c

    SHA512

    fa7a88e1a98706858d71df6227654bbec0abe11c087ff9aa59faab354d82d6862891a415f82b5c03580bedccef3685bd8477922a3b2e52ed31fc67adae05b8c2

  • /data/data/com.amateur.crime/app_DynamicOptDex/wdAnr.json

    Filesize

    35KB

    MD5

    1e6cd9fde99b9cf84b7cf9a7cd0f578f

    SHA1

    b36499cafc0de31a1af9d4f11e379411e40a73a0

    SHA256

    4a0b5f4434ec88fd1e54adcd520374bacef99d319fb3751e0cf0595fffc26702

    SHA512

    90f2db9fb576f55e5ebc6e5436fa454aad9b8c35a40cb7ceaa1526ddee9f788ae6e7cc5bb3be4afa2dba9692307809162a47a0069d30e375b767a42c857943cc

  • /data/user/0/com.amateur.crime/app_DynamicOptDex/wdAnr.json

    Filesize

    77KB

    MD5

    fbfec32963eec74794d898179aee8b56

    SHA1

    cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

    SHA256

    d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

    SHA512

    f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe