Analysis
-
max time kernel
78s -
max time network
155s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
14-11-2024 22:03
General
-
Target
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.apk
-
Size
1.8MB
-
MD5
e7e2f6d3f4dd11eaa700e91c5453c1fb
-
SHA1
ac4534de63725c1bf08e3eb0d069279e26dfffdb
-
SHA256
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b
-
SHA512
02e3f34a7073ceee74093fdefc2dc8a012e0d0c3d0c5cdc06ef5441ab54765d999a95b922bbe7315a90635f99e49f9b9e0f8331e35697123db5067609bb72db5
-
SSDEEP
49152:M7/1f6YGBpltmVDLth1DTXuFHE+2TLCBem2WhLHW:M7/IHmVn9TXKP2TLIemlY
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.amateur.crime1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD573b5662bb5e8a663c8a4e051f0393332
SHA13182acc6edaf316568e2c1a49b191acaa754ea3a
SHA256b177f89593c567570e5b9703ce68af62d15f5dd720aec976f61e5b7a527f961a
SHA5120bd856b417a2721004e76c593555098b683ad4be9a91ade955d8b989ae5f2b61c042e374a4f0c26abbb212dac8995763ea2f7b0ea590daad65757627816c12cf
-
Filesize
35KB
MD58acd55c8b9474bc98cc5a9362f6dcd47
SHA1761fe5911be43bc492c73cfb2e72a73e299bd42b
SHA256b386e93c90096f70f16d66efb62a3b4196cc5e15f8aa7313eef5e9d74ae82e9c
SHA512fa7a88e1a98706858d71df6227654bbec0abe11c087ff9aa59faab354d82d6862891a415f82b5c03580bedccef3685bd8477922a3b2e52ed31fc67adae05b8c2
-
Filesize
35KB
MD51e6cd9fde99b9cf84b7cf9a7cd0f578f
SHA1b36499cafc0de31a1af9d4f11e379411e40a73a0
SHA2564a0b5f4434ec88fd1e54adcd520374bacef99d319fb3751e0cf0595fffc26702
SHA51290f2db9fb576f55e5ebc6e5436fa454aad9b8c35a40cb7ceaa1526ddee9f788ae6e7cc5bb3be4afa2dba9692307809162a47a0069d30e375b767a42c857943cc
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe