Overview

overview

10

Static

static

6

0dfea11856...10.apk

android-9-x86

10

0dfea11856...10.apk

android-10-x64

10

0dfea11856...10.apk

android-11-x64

10

Analysis

  • max time kernel
    81s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    14-01-2025 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0dfea11856c4ccb85165ab31a3e7a6cf877e834a9170266584c86eed4394d410.apk

  • Size

    1.7MB

  • MD5

    35315dc19736f07eb33bd73775c2ea82

  • SHA1

    423f89cce778fee2610ad77caa90b164d2efefa0

  • SHA256

    0dfea11856c4ccb85165ab31a3e7a6cf877e834a9170266584c86eed4394d410

  • SHA512

    54aac268e36d167f4fc60faee973053850dc0d699c8553827ed9d9c198431141a2496b2704f16d2dd57698820400f9e73f3d647640cff3814bcc3c2ea574e1cc

  • SSDEEP

    49152:yUaSlO6UajLKrKlijxscjgVunVrgyk/9ygYmhFuONYIc2biMQm:yUaGO6UajLNglgExgx9/1hFuONU2biMP

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://162.55.21.189

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.share.seed
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4262
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share.seed/app_DynamicOptDex/PZST.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.share.seed/app_DynamicOptDex/oat/x86/PZST.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4287

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    e55668923d7c9aec5e9e52268f37b14d

    SHA1

    0db9c06d230c7bc5fc32bf9bf7e284d10e1044b7

    SHA256

    b72a3b59a5d38ddcdc50349a474a24b95baabac945165cf808c988c50d1494c9

    SHA512

    ec1c90283003644156d5905a2727630baf148c8c920ddbb8ff3b0e6cb9a9f35bffb5af320fbf90c3483aa05b958481dce8ef2348117ab9406fc4a717bec41ac7

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    63KB

    MD5

    decebb743a92fe0a0acfdeca968c5d6c

    SHA1

    d32c12030a200b5caf85a07c09dc063ad5431d44

    SHA256

    a92ea079b1602ca7a43ca2048e16475c2832a1b9b98c9602d30779aff6fb3981

    SHA512

    434557959be34d19c1c0b28a74d55c75aa44e97bab79fb55c03f66d29ae1856e78395976c27af6f3c1f4bf972753ab950339877ab7bb9c59cbfef4d77f2ad261

    Download Submit

  • /data/data/com.share.seed/app_DynamicOptDex/oat/PZST.json.cur.prof
    Filesize

    815B

    MD5

    468b2969a3cabbb9678e7b1373e952e8

    SHA1

    0bd30acd2b0cb0553a80983cd52f955eb88f8560

    SHA256

    9a8abdffa55be7f932c1b4117ed70eedf9a981c8d18f5360bda1cb2d63cfdbe1

    SHA512

    7d3df6132ffeeb1fab0bab0fe87b843adcc22de36b09d8e71b01f174698bd8d292237f27bf8a83e64023491d1a8de94b135375d23888077d9979518480bae8b4

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    02d0a7ebb9a9e83f1ff75fcd631bea91

    SHA1

    4227f46b3c07a93b585a19fa1b5294ea616abcd6

    SHA256

    086694c946a8b7407e34734d221148f1c52fe9d0e5a0d680c707a586427c4852

    SHA512

    3554ba5cdee20b4a252d43ec45540a177c7f5bfdf0febc0c2abe1d48450a0284fe2108a0392765f524840572824a15642fd6c5aeef3221ec16938835651047f5

    Download Submit

  • /data/user/0/com.share.seed/app_DynamicOptDex/PZST.json
    Filesize

    124KB

    MD5

    bf3a8b20950af2241e402aa6c819bcbf

    SHA1

    fbe7196d34d9fff857087a88a95df291b02e52c1

    SHA256

    307be83b576c86145b3783ac63ee9f0d99cd759510a8fa5d346bb6a65c8c47af

    SHA512

    68ac1f6de65006b9725ab9272d2cdd320e2281c411a5d78d181cf58e343a19c9496ad770d0a9241e15be2fedf2340ed6bc6cd9feb5cdead3087ff1adcd5232b0

    Download Submit