Analysis
-
max time kernel
68s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
03-12-2024 22:16
General
-
Target
ea35a3573f84a4e2347b5aa0fb5f9eb94117c7fc14dfc01e6b381742458d4f2f.apk
-
Size
1.3MB
-
MD5
091e800df43d82b9ae4600f7816bc624
-
SHA1
ca0585fb197605c7ffac0fe7557e5eb2332eda44
-
SHA256
ea35a3573f84a4e2347b5aa0fb5f9eb94117c7fc14dfc01e6b381742458d4f2f
-
SHA512
6610ce0e8387ee982abc80bad7c721fc30333a4694ab3e02382b19fc50e361cf55aa3c0d571ef2852dbbbe7739fba60c34dfa86e061455b2504397694abeb71b
-
SSDEEP
24576:03Z5qKYGSjIRPF2Xu6VJqHAHVa5yZtWyTV0e/FzJxL/GrKfLiSKemRsWhWmAo:2Q/GSjI32XuXHopTV0uFzbKKfLitemiW
Malware Config
Extracted
cerberus
http://80.87.192.227
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.salad.quiz1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5c90752001e25a379d1ffe910f6c871b1
SHA184f5427fbc7fac276fbc677964e49292fe0112af
SHA25641ec07fc5489948b037a5ba9589ad336568f09697873eda471fb2e8115a0a689
SHA512306117269811c1e206aa40a4bf55d7e820ac6d690a021b3e5c5b1fcac18b7d813f89b17b0fc71c1147bfcb9780e255d755fcf044ff8ba986782d252b5d36414d
-
Filesize
34KB
MD544bb977c1c70207ce20a045349a9913c
SHA1261cf17fd8a4cd5a780dac485934692d51bb2753
SHA25605b8759f1388eff765263018dd6fb878e2dc0a695a49f425fb1fcd15b3249e7b
SHA5124e0c997d4cac3b3c0cc2ab92b60725b1c313993b34b12c3179bcec04b6a0b68386ad7fb6d40e51f0bbec89c60ded7862727ef2c77cd030400a23ba81956babab
-
Filesize
76KB
MD5262d9655c7d686d31b55aa1976061517
SHA15f6d350e5e6ae66afee5ddddf4aceaf5dcb8899c
SHA256df1baa0be867f09df28532c5078b0c84f1f133e5b33182143f776ae3751779b0
SHA512b660b7636b06b2aff6e4da60346424ba6902a3e247760e211f628b0ad582d36eff04acbba3e600442a0da57449316f458643f49ff34ce82f2cc8dfbe2e8aa16b
-
Filesize
149B
MD548ab56dcc5cf0d821b5b7e8d70c893cf
SHA17f2e4c33e6d3b34723ecc6e00c53bd4c51af37d4
SHA256b6581b6b9b5850c7d0c0c8c52161674ad8d12204e1b3ce11630d1163c5044486
SHA512266d25a465f2ec723f8d9736f4ef69fe402044b7d6438463803da0a56c43cff856a089b00e7365c08457b477220ecb5cf4b58ddbccbcf05ff6952c4ac4aedf2d