Analysis
-
max time kernel
48s -
max time network
155s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
24-12-2024 22:02
General
-
Target
105826ea06552e2df460ba061208b80156e6e1583b36954aecd9d19cf621c4b0.apk
-
Size
1.9MB
-
MD5
e025df6f6fd4fb2ddb0e2fb578187ddd
-
SHA1
00f6f090e0e9007b5bfeb79ae83aa2ed33efbf9f
-
SHA256
105826ea06552e2df460ba061208b80156e6e1583b36954aecd9d19cf621c4b0
-
SHA512
6bf7463434e582caa7b30b4d0f7490338399250fabd301b8b0913d030d4e5766a7f3eb30ac0b336646cfcddf4f0bb32cf62ba95606be3b974bb5b7d004d86490
-
SSDEEP
49152:Cj7jvlXLnXQuihAFtwflNvR/g0J08016fljXOykIdcl1dIpkJpRD51O:CTvhgmAd/nXOJaMp1O
Malware Config
Extracted
cerberus
http://5.161.217.34/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.axis.author1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5e0d3da80b60a7bb13dbdf77350f0c909
SHA101b1408f02bbe4aac418e5391d9ace0845db07c1
SHA256c6077765a049f17719837d2d8cbc77b8a65a1f749450a564268a07f32460db1b
SHA5120256b09bd285f41cbb5ad087445d907f7714a211749d9563d9c0020a0162e1b0a8de99a2d12e1951a91983486893726328295e6cb753df8396bbc0a86f27ab97
-
Filesize
54KB
MD50cd70b0f2d0744fb0bd672e7b86dda63
SHA136d57e21fdb4c81a94b3c24a5f87ce12d0e2678b
SHA25636d5ad5d4a712657a9685a485c94c14cb3363a063b538b3a2db2abf643cb5162
SHA512d6a9effa7b7a5e7123af670cfb14526eecc5d2fed2125eafe0fb169aa17ee045636bf5d9196397b37fbc46f9752a2ebd5a81c5dfa012a9e8f2104b143168f381
-
Filesize
154B
MD5d3b453da6c9df354beccb9660595d101
SHA1792b87fea87d1d1962931d80ebbdff47b0fe284e
SHA256b2fb53579436a62b5d4428369be3b70f5782505fca2908fdbe78b8b71a65a24a
SHA5124e4147c2cbab2f8397e0c4198141053789675b53d517185e366847c5d8827f2379497b5b6d6d2c20eb333e06c7bda9a3007c639ff69a4ebf318426bbb50dff1b
-
Filesize
103KB
MD58da650234783dbfb5c1ad2b30c423bd4
SHA12d0e71af37e0434f980835ee79b9baeb6d447dcd
SHA256843f59e77ed4ff7037af84c868831b4744ca68e25ab5d3ea6d3119fc48f60b2a
SHA512e6f9dbc9a4a896edf09d77b2bc87a6f235a848a29f12123d654eef99b43595f335efb02c2a51cb1df333338fa3e6b17c1ca958285e091d30f5194b6feaf68bcb