Analysis
-
max time kernel
55s -
max time network
896s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
13-01-2025 06:03
General
-
Target
26e29dab79d132b3141a216d2729d71d652bfc756aec1ed02061363438fa9756.apk
-
Size
1.6MB
-
MD5
746b0f235ed2447818733c3cc28abe3d
-
SHA1
abe019e5cd567fb6e060d67b9877fdd1621b3908
-
SHA256
26e29dab79d132b3141a216d2729d71d652bfc756aec1ed02061363438fa9756
-
SHA512
8865e1b8540c0249a2ccddf06e5c2206bf85bc64ca6771315e49ca187aa79ee24cc9fff49bea10900ae83046343b005c74ad3a73edd11ceb63221bd7e0b6ecfc
-
SSDEEP
49152:ijXZPg/xOyTshl0rPyfJ3hdfutMbCilbLXTZv:ijZI/xZTshlePyfJ3hcgFrVv
Malware Config
Extracted
cerberus
http://188.120.228.245/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cradle.sail1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e668731754d3d17eea630d940cf0866f
SHA1a8d8678e8ae70cecaf5060f580291a5ce7b88281
SHA25610ec8b8710a8f57763f8c823aa2e0b33b742c4a117b5e4ee02a1e8f8403d6de1
SHA512a13520858c7dcec951080cff2d3804247321902effc9412692c67e765e5c1434d96d40473e52c2bcf97a0b1f52812be874d32cd4b773920153057040cb8fe5a8
-
Filesize
64KB
MD54a94880cab5acc5712f81e364dbdb26c
SHA1954a10a3b95eadd1016b9678a92636cbd1fc0d08
SHA25678423b2334697692f9037db581b6cfee907b1ab9dc611c16d7145ece2a17733f
SHA512fda660e6e296f00586ea9332209efd09988d4d3f4bab90af9e60b7d61898db24f79b1e9ca31dbd53a4ac4933cfeef2d45fd804e00b1c681878e4e3083a76a90b
-
Filesize
118KB
MD526fa0f83291d4580e90abd9afbe8801f
SHA1909d65523a0ec26f954c90ad99ad32317283b7be
SHA25608a2c2ddeea69bad4702f1ba127c8846ff989cb51b5fc21ee0e71b7df826f64a
SHA5121e0bd965bac4933b5fc85982a4533e8e8ce595469aaef6639d5d63d25bf2e65d367a24023d724f625be2fdc3e9d49107b01ca8fe57791572f24fc3237412164d
-
Filesize
152B
MD50c3843232262d23b14b58dc843c14564
SHA184369e5ef7966f2ce4416938aed9ff8f200b46f3
SHA25603175c9b415f9f0e0e9bd508bcf615554c0500a2e7b927bc6e9c8c79a487e904
SHA5128086938a40eafa3d7e1e8adf68e1cb0aaf809240c59902611ef1c4f50d3c239f52d66460044870241923d483aeb378010592a7ad1580a7ddc7386b08491695ee