Overview

overview

10

Static

static

6

63e3a5ac3c...16.apk

android-9-x86

10

63e3a5ac3c...16.apk

android-10-x64

10

63e3a5ac3c...16.apk

android-11-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    30-11-2024 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63e3a5ac3c464dcf9966b47f05a5d5be8e0f973bbb62921061d620355a371316.apk

  • Size

    1.9MB

  • MD5

    f8417b413c645255e9e571562aa05ef3

  • SHA1

    d28dd05380705894fb1d89f17e95b47bedb6ecc0

  • SHA256

    63e3a5ac3c464dcf9966b47f05a5d5be8e0f973bbb62921061d620355a371316

  • SHA512

    273f74482fd8d681da3bef7bd254fe811b4681a559c8170a6b3bcf4216907fc0aab4a0552f108e3de681b48c3eea5bab1c9756483b94ad1ac4567e21fc3b551f

  • SSDEEP

    49152:y1knunSDN+CP6lscmDxzK0J0801yfFr3MM9cl1dIpkJxRsTd5hs:y1kgYtpzZ3MOMYT3hs

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.lemon.payment
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4259
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lemon.payment/app_DynamicOptDex/Buqw.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.lemon.payment/app_DynamicOptDex/oat/x86/Buqw.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lemon.payment/app_DynamicOptDex/Buqw.json
    Filesize

    53KB

    MD5

    5e05a69c0310aff5d6da40dfed271314

    SHA1

    aa931b7a7c800e4d81196ad32624e734735ed02b

    SHA256

    0b3c91d692738d9f5290284bceb423aca397277d28356cb1bc413d5aae196b76

    SHA512

    adb40c6eb48853f0ab3dc05bc4e97ced0c49c2572d995ff0f3c6848558d0d540fa6dd9a400116556261598f7a3ce807ebd97fb0a87a566a80e9e4197fc069061

    Download Submit

  • /data/data/com.lemon.payment/app_DynamicOptDex/Buqw.json
    Filesize

    53KB

    MD5

    dacf14beab828d9256fab88924a26f92

    SHA1

    bbfd21cf20d140b0cfbc6ee00b11f5e67103fe23

    SHA256

    5f3e2f83f830f7199a75ce044291ec0c77d7d16dbcc93c5320a745bd0abd54f3

    SHA512

    16b19bb4b58ceb75a91e8b8684cac4f03b358abb0c77238fe6796d625d0dfdd8d8830e4be0b166e01df7340f9a98dcb8f6dc96b102719e86ae2160a0bd3cdd9b

    Download Submit

  • /data/data/com.lemon.payment/app_DynamicOptDex/oat/Buqw.json.cur.prof
    Filesize

    811B

    MD5

    837afd9e9360cf919c71c930c9349107

    SHA1

    e2db0641e0924230685b4e4470eb4cbf9c91af3d

    SHA256

    69b11fb7536b7202b83d0e0ef1ba677569083fbef17368de27eda68b734deab2

    SHA512

    381e33f51a23dc7728c23a0ef76c2ceb48581278341efc79252bd03c68070ca1dd5fbb2f105d2cead1a4932a176f793e6d95e10df75916f92d967e6b0f079e03

    Download Submit

  • /data/user/0/com.lemon.payment/app_DynamicOptDex/Buqw.json
    Filesize

    103KB

    MD5

    c8298b987ead5a31f05d4c6735f677be

    SHA1

    8ea1e79b8a6a3946dd35777d5a48ee1f45ad1f73

    SHA256

    16447da922f3f20f6d1ae0ff76fff15965821a0a734ebf19b5d8b04db1c1a370

    SHA512

    12a8e0e10d627cd17e5f77a153d51bae01659fc631a83ed34628145cfa28eb25799b8ccc152c602d0ba0fc0577c49bd7d3ec411d4874e257e71e9ca00da9dc9e

    Download Submit

  • /data/user/0/com.lemon.payment/app_DynamicOptDex/Buqw.json
    Filesize

    103KB

    MD5

    370fc68e8cef471d04059b898b87ed9b

    SHA1

    6689293719b8321c3ccae3d4ff4a73b98ba674d9

    SHA256

    ed4241d9f7bdaf0d32bed0f098d0c8ef84bac527c19239f5a1881932cb68f198

    SHA512

    edefae1284e11946d5b25a1ab56159bc93f492dd72457aeeff4bc8d93bf7c94692e1185a6aaf21a30d007328db7f21ee7386303c38d55e3b55a0c760b153e255

    Download Submit