Analysis
-
max time kernel
42s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
07-01-2025 22:08
General
-
Target
ef56c8e17f74cc6f15a76fba452fe21247d9eb2fa16f6ca13a14cdef3821e897.apk
-
Size
1.6MB
-
MD5
31e034989993695eb9705de8d9f3c35f
-
SHA1
920aef8bc55795615149ea4f33ad7717dabf39da
-
SHA256
ef56c8e17f74cc6f15a76fba452fe21247d9eb2fa16f6ca13a14cdef3821e897
-
SHA512
0a2ad5efb90210c381803eddb66903898680e690d2d9f559c972c3b056f4bf15663462453479a773234bab3af79e15a0272af04878b7039f42e9b91d6545eeea
-
SSDEEP
49152:SHOq/KKhMvxlYVfWbozBBaQbJ8He3we7BL1+G:S1KKh0qpWUzHa5y1x+G
Malware Config
Extracted
cerberus
http://188.120.228.245/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.boost.surge1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5a01f471cf6411d070ef2cb36fb1bbb50
SHA1b9248df4f65d058ebb5b22ba1bc749f82aea73ec
SHA25672ffee64fc877a32a7195ac9333d4695aae321e9a35f174abd3a2924d5cb2327
SHA512e8bbf2b67de34cbabe1b0ed2ee373da827c9d4574f62a6d19fc02c20417be231e52b58f995fc197d6cba6bf9656cc3cfc1183850da15cbf772d039f9203fdad0
-
Filesize
64KB
MD5380f967bfdb28035651ed6dea1d44e29
SHA139179376c35923c2e30c469de0d6f9940f211d4c
SHA256d00ff167aebbc2818f6dcbc511144c7e29e7802b706301b25c071ce8267a382c
SHA51261b4e9d8281a031019529d840ef8ccc3f9faa9586c7b22aa34fd61affb32518deca9aaa146b705251d088ac866273f6d82e7ebca63eb65f45b21db7e952b1d6b
-
Filesize
233B
MD5f349833a7cd127e7e8150c13a1b8f607
SHA1c6b5583e9feccb00b8e3c3f814a4e5c9cdddc8b5
SHA256b8ccd716d1204fe1f2052c403264c0f7c8849dd251c619751d92f9ec79b99302
SHA512dbc0e6b08104baf5d7d7ba8706bf93102fc01a2f737aba002d9d93353b6bb2a42bf2a76ffb5193f6404b48861f1ce8bc4767bce0f6e091aaeb6d97062f7b3557
-
Filesize
118KB
MD526fa0f83291d4580e90abd9afbe8801f
SHA1909d65523a0ec26f954c90ad99ad32317283b7be
SHA25608a2c2ddeea69bad4702f1ba127c8846ff989cb51b5fc21ee0e71b7df826f64a
SHA5121e0bd965bac4933b5fc85982a4533e8e8ce595469aaef6639d5d63d25bf2e65d367a24023d724f625be2fdc3e9d49107b01ca8fe57791572f24fc3237412164d