Overview

overview

10

Static

static

6

c23337d404...2f.apk

android-9-x86

10

c23337d404...2f.apk

android-10-x64

10

c23337d404...2f.apk

android-11-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    31-12-2024 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c23337d404c6c8c8856bbf249337d55b73b7fcfbdba53cb458739b8bcc39ba2f.apk

  • Size

    1.7MB

  • MD5

    4f46fe3d2566ade3dc1469c3c1b35787

  • SHA1

    08836d97042051e54c9caeddcaf53f8074f5d882

  • SHA256

    c23337d404c6c8c8856bbf249337d55b73b7fcfbdba53cb458739b8bcc39ba2f

  • SHA512

    8bcc2fb1b29e0c7d540287278c92a9138f5d80efedfe580e98586d14f0da82b0b7764f3327875635d4ecd3bebad03b5bb6a6d15561cc94509e753ce8be84ff68

  • SSDEEP

    49152:esE0VvrxL70Dlr/wUYSl6W6CyZmUo1SHTfLLt:PvdLMrFyZxbHt

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasionimpactinfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://188.120.236.119/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 2 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
    collectionimpact
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.year.shed
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4778

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

3
T1628

Suppress Application Icon

1
T1628.001

User Evasion

2
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

SMS Messages

1
T1636.004

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

SMS Control

1
T1582

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.year.shed/app_DynamicOptDex/QF.json
    Filesize

    64KB

    MD5

    dc4dfe03927ab255440ae50bf17f5b13

    SHA1

    5b0b36f59f744b9a4ba2caeead09938f6aa66d84

    SHA256

    02594b578a4ce0efc8f8e9a131f59d593bbaa918b889caf0633f518447ba5f8d

    SHA512

    fd3d777c0073a2484455bdf12d2b346a6e35b11efc3f180ec26ba2c73829beebb7e85c529b2b61c6b148e05e6243a7abc950db19e93609dc1623427e367f1f50

    Download Submit

  • /data/user/0/com.year.shed/app_DynamicOptDex/QF.json
    Filesize

    64KB

    MD5

    9ff89845fc65fcbf1653efda2d1382ea

    SHA1

    b7c8adc40acbb33d3ee572dfb08df987500d602c

    SHA256

    0c7c8a7e3c9edd774c7234ed8b400e20862a67fac4199001397fee1ecfd2f9e6

    SHA512

    75470a63f658544edcc4cef7816db22b506617fd33f368321e252f98e82a15583618be382fa2b68a3aa982fa2ffa33f6b17735a43fa9c6005577c99edc0a8087

    Download Submit

  • /data/user/0/com.year.shed/app_DynamicOptDex/QF.json
    Filesize

    118KB

    MD5

    d3a1e2a92c440d9a1127ed0df9d6a87f

    SHA1

    a81c6f74437911ddcf9cea3e3f4bfce579d7d07d

    SHA256

    c19624de740dee2572875175e52756ec38803d9a818091aa0228e880e5f79a87

    SHA512

    a6805b109027c00cf94d76a5cd1a15980a792a16d6b60cd00e23bdc9d8579c50460b8e1fde29127aa4c0660bd0e808518359f948ec1c6ddea14c29407ea9d703

    Download Submit

  • /data/user/0/com.year.shed/app_DynamicOptDex/oat/QF.json.cur.prof
    Filesize

    145B

    MD5

    fe39504d6d36ced8d38baf1c5f529348

    SHA1

    782385d7d7686a15a74627f32878a49f4a1602b0

    SHA256

    e1307099407e5999a8de5ab6ad8386bd9ff8751999694dc4a72e874f8a7ac66f

    SHA512

    4784ba3ce1a77831216832db0b6a0fe3d519a5361262d3cfe3198b1ae0f59b70011653cc69dfd4452664b1d01a420575f849ec4de10309baf677de3a89e892d3

    Download Submit