Overview

overview

10

Static

static

6

e47c787c81...2b.apk

android-9-x86

10

e47c787c81...2b.apk

android-10-x64

10

e47c787c81...2b.apk

android-11-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    168s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    30-12-2024 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e47c787c819e88bd2188bc2016d974cf5b21ab278c811c6f80b2c8731c5b162b.apk

  • Size

    2.0MB

  • MD5

    d40038df72ee6bb8a9a78ef60dc8b015

  • SHA1

    d842cc95bef6e9ec848a50f2ce255e835f4b1327

  • SHA256

    e47c787c819e88bd2188bc2016d974cf5b21ab278c811c6f80b2c8731c5b162b

  • SHA512

    1cdb26a82bc2048cacf812864f1660459a87c4fb4044981db0ad0d8f324a47a4f88b812ede96f248b616be0e8c9d6ac5d21e1232891c98b99abea2c69321e82d

  • SSDEEP

    49152:Cs1w/M6NuHSaK2P/hVkZdUtnD4WHKNHaNcOvem1/l:CsFKpGvWUD9HKNKem1N

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://5.75.176.47

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.sentence.senior
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4219
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sentence.senior/app_DynamicOptDex/JYe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.sentence.senior/app_DynamicOptDex/oat/x86/JYe.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4245

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sentence.senior/app_DynamicOptDex/JYe.json
    Filesize

    54KB

    MD5

    d9c0133cb61e19cff9c8042fc0d4cbb1

    SHA1

    49f8d4e6fed804bdea3046f5722ea5ea8b90e263

    SHA256

    7779eaef93c278741cc6f8d95e7137397f3479efe17a9081f6d4004dab539849

    SHA512

    abeac8316ace4f78cb935a52db25b40b8360c02b6325887350c620780fe46f9387bb350b4bb4f57917946b60f75af25ad9fc7abf4fd227a5ae27c81e97b54b4d

    Download Submit

  • /data/data/com.sentence.senior/app_DynamicOptDex/JYe.json
    Filesize

    54KB

    MD5

    8bfac8049f12e5e2dead73943dff5726

    SHA1

    8362787fd6eb292ee30d31493f962e72cfedebdb

    SHA256

    86d794727c347e091e4e6cd286a2392b39da15ef27a113d03a48c715e79ff67c

    SHA512

    c4559ae4d83f137ca498c5d830622e10d83d92e9f89ad0e4a984ba241b5f3c818803614167df7a0c5c0590e8156b4368e03a2328a07187337d50f243bf1a073b

    Download Submit

  • /data/data/com.sentence.senior/app_DynamicOptDex/oat/JYe.json.cur.prof
    Filesize

    821B

    MD5

    ffb0c28bbdd8341ff6c42b798eae997f

    SHA1

    7960014cf4738983783807cca84f1f5e114e3bea

    SHA256

    203ec4bf425ce71eafb75db48387757940dbc55e3028998f8bafb0fc2653bd2c

    SHA512

    6a6f95921be934a794e5b831000c732a589053bd2f6aaf39984609dddef24ac2da5b81e50deab5ea4ba9d9bc862da8cf2845f9dd3aafd789baf4b25a779545c8

    Download Submit

  • /data/user/0/com.sentence.senior/app_DynamicOptDex/JYe.json
    Filesize

    102KB

    MD5

    58b21b9b039d46039341fd9253ba7206

    SHA1

    fe9c7e2799acb733485e39254632bd52063a7855

    SHA256

    bb1e6d9106b65aa2a47c3be5a6d4c0ca25898f932b197e40515086f43b404675

    SHA512

    1aaaa0e38ea9cf2089fe66a8bed1774ad1011cb9fdc6a48f42e4d18a1423361b7599ef206b9e1ea2bd5044e078d825355fb4f761aa99153084f69c5292206428

    Download Submit

  • /data/user/0/com.sentence.senior/app_DynamicOptDex/JYe.json
    Filesize

    102KB

    MD5

    51809b6bb1b61100944d3dc23b31b40e

    SHA1

    a22b9dae49cd88724bf089e0a9cd87d61150ba94

    SHA256

    9321b44bebde5bc321aa1618aaf8e91571dcb2f068aa9bed5d9c936b43fb2027

    SHA512

    42014decb8e52efd198321134c6c7c547fc30718576c2d8bca9cd410782cdc9b3753d7400e75f82c081873d29de96c5175be90d22647390d4f003c811cc06f43

    Download Submit