Resubmissions

16-12-2024 22:35

241216-2ht37ssrek 10

12-12-2024 22:05

241212-1zn3vaypbv 10

Analysis

  • max time kernel
    48s
  • max time network
    157s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    12-12-2024 22:05

General

  • Target

    a882e22d1b6ea38cbe565ff252757c2f679cbe43d15b8f63bfcc5b045814bf21.apk

  • Size

    1.9MB

  • MD5

    99755c7fcac1dac8d576ca86fa80f6c6

  • SHA1

    550691fce8fc6ee46963672c6a4642401764d7bd

  • SHA256

    a882e22d1b6ea38cbe565ff252757c2f679cbe43d15b8f63bfcc5b045814bf21

  • SHA512

    ceff2147db4738f247120612c42e273445a777f4b98693a1fd2d6924b1313b566cfe1dab162c174dafd468462046fec524215f4f242b356777e72bb2221c60b9

  • SSDEEP

    49152:sh866i3Z5U0yig7XzrEXNq0wi0J0801XNCPE8Y3qiTYcl1dIpkJmRF579:CVpZ5UCH3wvE8kqMc79

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

Processes

  • com.kiss.lesson
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4853

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    54KB

    MD5

    0a37ad2e4b08c779b6b5394b62558004

    SHA1

    d6bb04e4f3f7c5b6d63dbd88d0356bd4da4824bb

    SHA256

    e5e6fa459eb49deb6404f7f0ef11c44123f4ac849a69de8ec9b2aaac4bd26e5f

    SHA512

    c1e83ac84405868fda0b49c128992c8b7dccea3360aebf34f51fa6f7d132feae1683cbeae8eb7f105e02186744a2228b51118c9e505cc71338278c337b92d191

  • /data/data/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    54KB

    MD5

    eda7acbea8ffa9aed628c9a0d5ef46f5

    SHA1

    6a1f31ef9050e63e2b37398600171944fd19c828

    SHA256

    1247066411d4cefc353508c8a324a846f0d96beff0ab63abe5452e4ae7f7b1fa

    SHA512

    0ce386bc52763f8f0c0b26d1d0ea21a1c8156ebd8adba941ca6635640e34891a76e96d6fa6ef748b20d66d3bb9ffa64e42ae41bf891253df0afd974eb561f3b5

  • /data/data/com.kiss.lesson/app_DynamicOptDex/oat/KqjBjOU.json.cur.prof

    Filesize

    165B

    MD5

    3499fbff3b91bbab57eb935092de754a

    SHA1

    dc48ffe63250faec9de66f6635c42961003fc85a

    SHA256

    9d9b3d0ad6b3ea8067496a03747cbc80150a8b54ca1b243b7abae5eba6089044

    SHA512

    7bd3039518bf84ec740c96f008460a1054a96afd93b0fec2c8d91e868e1c869534eb0451aa77f9bb8486c01a3ee6f8dcc1ea471b04ae984bddd8788e8e3dd8bb

  • /data/user/0/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    103KB

    MD5

    2597967b27a832a4a0fae00c3bfec0c8

    SHA1

    964992e5b1e5858a12fe78ba0cc97e7f8c43e47d

    SHA256

    4bcf149f3b76df0ec62c90580633925436cd7dddf30b932c99fdedfc26bf4b32

    SHA512

    809eb84ffec82d59eeb6b60c9ad80e32c08a7e7b68706c8a7fe5f13063149234813f64629766c4f768cf8fe9a6bde8ead1e1fceff0a3f8bf123844cb7970a0ea