Overview

overview

10

Static

static

6

c52cba75b5...9d.apk

android-9-x86

10

c52cba75b5...9d.apk

android-10-x64

10

c52cba75b5...9d.apk

android-11-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    16-01-2025 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c52cba75b5bdc67fb39b8462c2c11b9efa48e5c0a02e6f176e8d5ef83268c19d.apk

  • Size

    1.4MB

  • MD5

    920e016f88be0bebbb1efdc9dfd09dcc

  • SHA1

    ce4f0251be0bfade89eed7cec87ce938406780db

  • SHA256

    c52cba75b5bdc67fb39b8462c2c11b9efa48e5c0a02e6f176e8d5ef83268c19d

  • SHA512

    7c0ae66cefff521fea20557463beb592865b140e91eaf56f72a833d97b351707764162d1721ed8774f1024f849c4c305c1a8ae8d1fda133562d5bcec70540127

  • SSDEEP

    24576:NaphSMT100tsz9jCeN9MseZSl7h2Rymh9pa/Nxz7TteUaQUaWynAzn1kBG5uptr4:NabPszwZSl9MpzUXP8UaQUaWzzn1aGU4

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://apiv1android.cf

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.reunion.start
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4314
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.reunion.start/app_DynamicOptDex/jdFM.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.reunion.start/app_DynamicOptDex/oat/x86/jdFM.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4339

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.reunion.start/app_DynamicOptDex/jdFM.json
    Filesize

    64KB

    MD5

    e95a584ae65b98137fd55a42a98399ab

    SHA1

    87bcda849a81fc61e441af79f1ce9f28bb760c35

    SHA256

    5fbc3003264cf81aa6fa34d63aee5c0f2cd125b88c2ea6c207db898867a92152

    SHA512

    f219d46919744eff77d6199efe7ae81d286af2c83a605f27e2548e1b64cdabd2128086fb6b229b4fd0cf0e340d21e4b09f2a43f254f7c9c833a5d5fc34da223d

    Download Submit

  • /data/data/com.reunion.start/app_DynamicOptDex/jdFM.json
    Filesize

    64KB

    MD5

    cf35f1f6e17bd320e44083a8c1b33186

    SHA1

    b990f5b2c4ad37b2e208a95e03174c00d5a59448

    SHA256

    ab8c79b4cfd2d019c58bbb25b659a8076a24a037e51fd3e23a065f0b4ee1049e

    SHA512

    a2d0e04b01362a0d5ed9dbe0c8134b6adb805ed3983136d56e1bf0bb45592c40a16d4be8cfe6c4e73dc5ece3bb06cbf6eb93638aa19e6e5b40a0c92f5164eefb

    Download Submit

  • /data/data/com.reunion.start/app_DynamicOptDex/oat/jdFM.json.cur.prof
    Filesize

    794B

    MD5

    82893a837a32f6cd0830317b7daea37b

    SHA1

    1b1b9a39a5f8c3c3f5a75f3b6c0eda85ae81e882

    SHA256

    9099800095ad43d7cbe9ed7ada5e10709017dc2387006b686864966f8be4b0e4

    SHA512

    8b91bea428ac492a46df25fa5231f3120353679f74e8d075855f24bc14cfa6199198bdd96cd3a68e6f3a838890ca5d179bf51f9f9fb0a054f686eee9593c430a

    Download Submit

  • /data/user/0/com.reunion.start/app_DynamicOptDex/jdFM.json
    Filesize

    125KB

    MD5

    6c23cd03bebfbdbbe6bb245c8bf50782

    SHA1

    a2a3aee51f57d340b146de29ae000d4086165f98

    SHA256

    61a7f44aac9ec9c051021c731f43cec8132bd5662176268e33d5de41811fbd78

    SHA512

    d697258db2c7cd92936f30260331982589f678d7a14d0cc75a26eae21159bd331b0786bac992574d6b05ddd46c47852904649e27fc2bb6b3ffdee278380b1583

    Download Submit

  • /data/user/0/com.reunion.start/app_DynamicOptDex/jdFM.json
    Filesize

    125KB

    MD5

    41b9220653399f4fee8abc651a6ca9a0

    SHA1

    8f21740596a9d05931753db569d11eda5be48f0a

    SHA256

    8650c0cc23b684220d3bc076b9074f001487319d07931402b5e484e4a946c760

    SHA512

    9107f18239d9f3f4513284c9b9d7be955d0c9a81fd42414972520efd13b01c38a2c6f6c5ad103e37f43a9ae9aafc0f9875e68cae9e87492b720bd633f98db71d

    Download Submit