Analysis
-
max time kernel
62s -
max time network
144s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-01-2025 22:08
General
-
Target
ef56c8e17f74cc6f15a76fba452fe21247d9eb2fa16f6ca13a14cdef3821e897.apk
-
Size
1.6MB
-
MD5
31e034989993695eb9705de8d9f3c35f
-
SHA1
920aef8bc55795615149ea4f33ad7717dabf39da
-
SHA256
ef56c8e17f74cc6f15a76fba452fe21247d9eb2fa16f6ca13a14cdef3821e897
-
SHA512
0a2ad5efb90210c381803eddb66903898680e690d2d9f559c972c3b056f4bf15663462453479a773234bab3af79e15a0272af04878b7039f42e9b91d6545eeea
-
SSDEEP
49152:SHOq/KKhMvxlYVfWbozBBaQbJ8He3we7BL1+G:S1KKh0qpWUzHa5y1x+G
Malware Config
Extracted
cerberus
http://188.120.228.245/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.boost.surge1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5a01f471cf6411d070ef2cb36fb1bbb50
SHA1b9248df4f65d058ebb5b22ba1bc749f82aea73ec
SHA25672ffee64fc877a32a7195ac9333d4695aae321e9a35f174abd3a2924d5cb2327
SHA512e8bbf2b67de34cbabe1b0ed2ee373da827c9d4574f62a6d19fc02c20417be231e52b58f995fc197d6cba6bf9656cc3cfc1183850da15cbf772d039f9203fdad0
-
Filesize
64KB
MD5380f967bfdb28035651ed6dea1d44e29
SHA139179376c35923c2e30c469de0d6f9940f211d4c
SHA256d00ff167aebbc2818f6dcbc511144c7e29e7802b706301b25c071ce8267a382c
SHA51261b4e9d8281a031019529d840ef8ccc3f9faa9586c7b22aa34fd61affb32518deca9aaa146b705251d088ac866273f6d82e7ebca63eb65f45b21db7e952b1d6b
-
Filesize
118KB
MD526fa0f83291d4580e90abd9afbe8801f
SHA1909d65523a0ec26f954c90ad99ad32317283b7be
SHA25608a2c2ddeea69bad4702f1ba127c8846ff989cb51b5fc21ee0e71b7df826f64a
SHA5121e0bd965bac4933b5fc85982a4533e8e8ce595469aaef6639d5d63d25bf2e65d367a24023d724f625be2fdc3e9d49107b01ca8fe57791572f24fc3237412164d
-
Filesize
149B
MD56cd29be0a3358877409712cb13309599
SHA1d81cb85ae3f4074f03d38c8a9a92782936960218
SHA256c33efafd1d9bd3ac03229a6566e9b0edfc92dbcf0c4a6004964765807c4c4fb3
SHA51207222dbf11d234b0474cbf0635cd158d9bcce86b7e1df2cb8049d95150119bd798f8735ad9a04166dcde1f7b9925ddcf9b4199b73937b7db37c2bc59e75ff675