Analysis
-
max time kernel
62s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
16-12-2024 22:00
General
-
Target
615b861ed6225b27b43f480ab638f33ea8509330989b13f08038599553d27298.apk
-
Size
1.4MB
-
MD5
a729a979527b84ec35a427a3b22448ef
-
SHA1
c4f3a103a96752bf53091dc599e5fcdb94be806b
-
SHA256
615b861ed6225b27b43f480ab638f33ea8509330989b13f08038599553d27298
-
SHA512
c54f4c5d0dfcc3498e9643703a72c79feb304d58f487fad0183186fb7e208742887e2f2300c256f0262d0c43129b8c2cc76e8c3c9323e01b8112e71a73155f57
-
SSDEEP
24576:2X6rlizVxoeY3qlXyEsqEcUSqOp36PNv6Rmtrt4re/F7+pex/cHPL1nKemesWhWH:zZixiu5vsq1YOQJzp4ruF7nEHPL1Kemt
Malware Config
Extracted
cerberus
http://petkinssaps.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kid.couch1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD559ff1dfe6a895706aeb0574f4c9f89b6
SHA161b818c0c2d5c8576d099e7f3adfee1f1fe56cbf
SHA25617ece2eb3f091a1d0f34670d39df88bac31bc37892367a6c536c2bc6c4bb12c9
SHA512caba4bd8935a8daa577c3cf54d7ce7c4a3da43cb134d1f54159b1e977c0a84b7ca95758ae7184ed68fcbc266532950359d3b04edd62e4cafbe73adf2c7ce7382
-
Filesize
35KB
MD5fe53c5bde06612f87def1eab5dca9be5
SHA1719aa8bbec5cf1bd2bdf347ef1bb703947f5702c
SHA25656a18fe936c584031d3b29058a57125949c3a82321a35b3aee93438616021213
SHA512ea9ad3fe5155606c6718c5dc07ab220e49853f97b971e5642a414ff0f4f1638709363c2307b116a6f5f031a201e699dc20255752f3f07226e2f5fa2292176358
-
Filesize
77KB
MD5453d3411c90fe94cf39cf29f49ea4a04
SHA1d48d0eb739f3dc991c45e0bfb869c6d851fed30b
SHA256776dca8dff7f768acac158dfa7af50844dd7751448f2da279db06c06644014ff
SHA5127a14c22d105422e09b021b79fcd32673e3e3bc6965439ec5a669a6c570be18104321a04e82508bf002e2c6b0dba6de5809fe45b4d9b0f15da12b2ddd41372d3b
-
Filesize
149B
MD558b26a5797da061f08ad5d97ef9072c4
SHA15a7f1cadf68b6c323004f89bb50670e5f18d6a19
SHA256ef12d3f487d98d84be786b5374183c1d84586256dc3f951fce1a2fb8b3eea154
SHA51294c8714d864d1b5a63d22ca62c88b08c08eb974f35207fad3a66d0278e7db3fc521ae12559018f85699109a62e9a417fc318d545c8272d8d1a11c926444a85c3