Analysis
-
max time kernel
105s -
max time network
155s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
10-12-2024 22:00
General
-
Target
9c7afcaff754719f597a43b13575dfe4eb8d0af733734b19f9acff0ae772019c.apk
-
Size
1.8MB
-
MD5
68d1cb04aa3109a03d69a1080207428a
-
SHA1
f0efcac492b6d021518449070b9672b434f5c8c8
-
SHA256
9c7afcaff754719f597a43b13575dfe4eb8d0af733734b19f9acff0ae772019c
-
SHA512
9a0e118464b432b563cc354b4885f2112582e161a82f0d11094fe4809dc324868f8264e84749015f95545568a901fd098090f2a0078ccfcd48f7abbb661cc0c1
-
SSDEEP
49152://XLnnbGbJI7zM9fGFAJap7kGKBNRuFnp4pvLbOemBWhLJi://Q+sGFAYp7kBRKWpvLiemEy
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.clarify.aim1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5dd6d1413bb86b7f93b4a652becc9810c
SHA174c7981d5439a77077e6c4029fc9db6e48ad0c1b
SHA256c1a4499285b7ab62233bb727fcbf2d2ed95497bf72a95a28628108cd7ec133d5
SHA512e39cdfc5656567a136d73dcf476f309b263fc6e863afd0fc98e6a5c74a58ed63eb60e897373e4275a5d6d402f1bca0d3c017f8eb866d480b280382cc44dd7257
-
Filesize
35KB
MD5e2ecc7206be385fe5a895df5a4354013
SHA19a7554de566ec08282fce8a5a99759cd0b31d809
SHA25693b334d6fb09146ce9b51f719fdfdfc27d5f787fb171822f7b01f0f4bb509ccc
SHA512822e979a7b984173390445e435f0b71ed6974e1b060afb62245da860663dbb53f2c0e4ce92c402527956199cc2e2bbf10be7a92b070ca6938459ee23c52e9b04
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe
-
Filesize
152B
MD557c28f09c25d4f928a4efabe66c5d363
SHA1650354753a364dc507e6929a1b37c251dd419998
SHA256165e62da98086de95a140ef0daa97e22623f8ba51b49266654310bd7b6d33f04
SHA5126e2dd2498dae5d6faf6c57ce632f8c7dbb631347cf39083dded05f183ccc56c76a284466521889f03def7a13520287de6c7279901d0163c1d70c98460443cce2