Analysis

  • max time kernel
    46s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    22-12-2024 00:42

General

  • Target

    e596834d65db453dd277ba35126f1c1703ba633100b226a18f1ada6b9c722f18.apk

  • Size

    2.9MB

  • MD5

    78e5c211f3aa83dde33736bfdb78de81

  • SHA1

    16c5cf6d834b9a2a0c30f3f4b6ff32ee4f6e2e46

  • SHA256

    e596834d65db453dd277ba35126f1c1703ba633100b226a18f1ada6b9c722f18

  • SHA512

    d35dd556b380181680bc1247e5c7818aec8db13a038bad93922d50804b98462034aa4f195e5c531f0a13b16517942b8f6db54f8d04733f76b90eeaed3c46d52e

  • SSDEEP

    49152:PNPzR7XNgs9uWCVW6G90H8aZwSFzeTOgdEg/ghZU0QfEecgHjAUXF+fdfhbp:xzR7XNguuRqO6OzeSgCgoI0Q8hSA8+rF

Malware Config

Extracted

Family

cerberus

C2

http://spacecomdomainscomcocspaces.space/

Signatures

Processes

  • seek.super.area
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4989

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/seek.super.area/app_DynamicOptDex/Pr.json

    Filesize

    118KB

    MD5

    890ba698f3268a8044b611be167ed55a

    SHA1

    427ef96e5e0d28bdc7845b7433c2bcc19cf923cb

    SHA256

    21a6372f9991bde72e55aabc58085dac5e7a5b7c7a872f2de861ba05ad394b16

    SHA512

    ae5b0877ff3d752aa9423d952f300ea1e6b06f7e87d50a33fa2ba99f0e58bdcd14022ebd166c667eb3fdb908e9ea999a31e1faad42391bc350f81fff073a036a

  • /data/data/seek.super.area/app_DynamicOptDex/Pr.json

    Filesize

    118KB

    MD5

    9b4dcbc637537c7b49cc9d2b0ac25139

    SHA1

    11e0f249cba8f2be4b589a5f5204ea1e6af9c2df

    SHA256

    f00b56aed0f59125ad6a2ea0bba82ce9d9d848cfbe3a35199ea28d5afd79246b

    SHA512

    cc2d91ad150473c8213dbd618b71fe6931377acaeaa1535fb9f3fcfbf9f7139622df06bec89b6bf8d871c078ac2e5fcad600a3e99c6dc5ed2f0593bb3c551ea2

  • /data/data/seek.super.area/app_DynamicOptDex/oat/Pr.json.cur.prof

    Filesize

    820B

    MD5

    1aa0d86152bf6bfb0f76c492c00c57bb

    SHA1

    48f98a38abfd0029c06ffa04aa276794b0259557

    SHA256

    44f960fb9454d877f5f30ef0590ddf64fff383902f97628f4fc2a2a4761413b1

    SHA512

    6bc33668b0576e2c3c7c2d29ace3cde9f85c6a2ad5f62d0a28cdd90e326c3c46ad39c4be3f3246611454540e9e95a5887312a8d99331c22f54f9a5e243792fd5