Resubmissions

16-12-2024 22:35

241216-2ht37ssrek 10

12-12-2024 22:05

241212-1zn3vaypbv 10

Analysis

  • max time kernel
    40s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    16-12-2024 22:35

General

  • Target

    a882e22d1b6ea38cbe565ff252757c2f679cbe43d15b8f63bfcc5b045814bf21.apk

  • Size

    1.9MB

  • MD5

    99755c7fcac1dac8d576ca86fa80f6c6

  • SHA1

    550691fce8fc6ee46963672c6a4642401764d7bd

  • SHA256

    a882e22d1b6ea38cbe565ff252757c2f679cbe43d15b8f63bfcc5b045814bf21

  • SHA512

    ceff2147db4738f247120612c42e273445a777f4b98693a1fd2d6924b1313b566cfe1dab162c174dafd468462046fec524215f4f242b356777e72bb2221c60b9

  • SSDEEP

    49152:sh866i3Z5U0yig7XzrEXNq0wi0J0801XNCPE8Y3qiTYcl1dIpkJmRF579:CVpZ5UCH3wvE8kqMc79

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Cerberus family
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kiss.lesson
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4389
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kiss.lesson/app_DynamicOptDex/oat/x86/KqjBjOU.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4431

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    54KB

    MD5

    0a37ad2e4b08c779b6b5394b62558004

    SHA1

    d6bb04e4f3f7c5b6d63dbd88d0356bd4da4824bb

    SHA256

    e5e6fa459eb49deb6404f7f0ef11c44123f4ac849a69de8ec9b2aaac4bd26e5f

    SHA512

    c1e83ac84405868fda0b49c128992c8b7dccea3360aebf34f51fa6f7d132feae1683cbeae8eb7f105e02186744a2228b51118c9e505cc71338278c337b92d191

  • /data/data/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    54KB

    MD5

    eda7acbea8ffa9aed628c9a0d5ef46f5

    SHA1

    6a1f31ef9050e63e2b37398600171944fd19c828

    SHA256

    1247066411d4cefc353508c8a324a846f0d96beff0ab63abe5452e4ae7f7b1fa

    SHA512

    0ce386bc52763f8f0c0b26d1d0ea21a1c8156ebd8adba941ca6635640e34891a76e96d6fa6ef748b20d66d3bb9ffa64e42ae41bf891253df0afd974eb561f3b5

  • /data/user/0/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    103KB

    MD5

    b49b9bfbbef6c79252d7889343c4c261

    SHA1

    3b0ab234a0346c228ad76dab764e6363fd53c094

    SHA256

    739e6ae135b74189598e1414a70963929613e75eb063bb4ad14e35e2d037d92a

    SHA512

    b2c8262a7b0aebe7c5fdc35b322598127eac8d0abfaf92ddf41622d3d3beaed94650a837b0da94ea0cd416babee7c1da7b1fb4c7c0b378f2e2b0b3a56252e5ec

  • /data/user/0/com.kiss.lesson/app_DynamicOptDex/KqjBjOU.json

    Filesize

    103KB

    MD5

    2597967b27a832a4a0fae00c3bfec0c8

    SHA1

    964992e5b1e5858a12fe78ba0cc97e7f8c43e47d

    SHA256

    4bcf149f3b76df0ec62c90580633925436cd7dddf30b932c99fdedfc26bf4b32

    SHA512

    809eb84ffec82d59eeb6b60c9ad80e32c08a7e7b68706c8a7fe5f13063149234813f64629766c4f768cf8fe9a6bde8ead1e1fceff0a3f8bf123844cb7970a0ea