Analysis
-
max time kernel
56s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
16-12-2024 22:00
General
-
Target
615b861ed6225b27b43f480ab638f33ea8509330989b13f08038599553d27298.apk
-
Size
1.4MB
-
MD5
a729a979527b84ec35a427a3b22448ef
-
SHA1
c4f3a103a96752bf53091dc599e5fcdb94be806b
-
SHA256
615b861ed6225b27b43f480ab638f33ea8509330989b13f08038599553d27298
-
SHA512
c54f4c5d0dfcc3498e9643703a72c79feb304d58f487fad0183186fb7e208742887e2f2300c256f0262d0c43129b8c2cc76e8c3c9323e01b8112e71a73155f57
-
SSDEEP
24576:2X6rlizVxoeY3qlXyEsqEcUSqOp36PNv6Rmtrt4re/F7+pex/cHPL1nKemesWhWH:zZixiu5vsq1YOQJzp4ruF7nEHPL1Kemt
Malware Config
Extracted
cerberus
http://petkinssaps.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kid.couch1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD559ff1dfe6a895706aeb0574f4c9f89b6
SHA161b818c0c2d5c8576d099e7f3adfee1f1fe56cbf
SHA25617ece2eb3f091a1d0f34670d39df88bac31bc37892367a6c536c2bc6c4bb12c9
SHA512caba4bd8935a8daa577c3cf54d7ce7c4a3da43cb134d1f54159b1e977c0a84b7ca95758ae7184ed68fcbc266532950359d3b04edd62e4cafbe73adf2c7ce7382
-
Filesize
35KB
MD5fe53c5bde06612f87def1eab5dca9be5
SHA1719aa8bbec5cf1bd2bdf347ef1bb703947f5702c
SHA25656a18fe936c584031d3b29058a57125949c3a82321a35b3aee93438616021213
SHA512ea9ad3fe5155606c6718c5dc07ab220e49853f97b971e5642a414ff0f4f1638709363c2307b116a6f5f031a201e699dc20255752f3f07226e2f5fa2292176358
-
Filesize
230B
MD5cef2ac106d4b3006d46b23c9906926e1
SHA152c44c1d00627f5eeda2100b051a3f15e740f27f
SHA256a9dce105fe3c515660eacd5c9178ee84c247e610d72ff5971d0ed3d53b3f2bc9
SHA512ae633c3006f4e59e9b197c666a14593f91973ee8c279d21b8a40408cb0d3d7cf3c321468b6979c11d5688375fbd28e6c478b207595587bbb07acdcd8352453e2
-
Filesize
77KB
MD5453d3411c90fe94cf39cf29f49ea4a04
SHA1d48d0eb739f3dc991c45e0bfb869c6d851fed30b
SHA256776dca8dff7f768acac158dfa7af50844dd7751448f2da279db06c06644014ff
SHA5127a14c22d105422e09b021b79fcd32673e3e3bc6965439ec5a669a6c570be18104321a04e82508bf002e2c6b0dba6de5809fe45b4d9b0f15da12b2ddd41372d3b