Overview

overview

10

Static

static

6

14a05dab2a...36.apk

android-9-x86

10

14a05dab2a...36.apk

android-10-x64

10

14a05dab2a...36.apk

android-11-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    156s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    17-01-2025 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk

  • Size

    1.3MB

  • MD5

    e7ec59ef18185b1296a71ccc0e77ddcc

  • SHA1

    c6a21a11d192b1e11a8d9556aaf1b42bcbfda959

  • SHA256

    14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136

  • SHA512

    2f27d381a7c288cb09177e52c07ff1a1276d929db66ebe95aaff1a42b55eed4b8bbfd5815a887f4b8860c2456ad2f065bd95f379c4ed2e9996539e704cb920f2

  • SSDEEP

    24576:CnQQRsClfdZTrGeXKCCdQuKc/XsRN8baXY9c2p5jjpeQqQLTAC+PGZsgK:CnQCXdZ+5xdocEPIc2rBeQqCAC+uZbK

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://194.34.232.172

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.seminar.goddess
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4271
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.seminar.goddess/app_DynamicOptDex/oat/x86/Theo.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4295

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    64KB

    MD5

    ed6c57c0e237f9abe38551da30c30817

    SHA1

    cac0e5e44338e615c4784dd7725935a5ccb161f5

    SHA256

    0e62e5afd9a69eda37e1c31dfc139f24fa14be21cc399e1dc3e3cbec0ab8ae91

    SHA512

    f4b7cad3affeb76361bd43461fa19bbf240de2674a89a79437486a258e27b344ae54bb2c1c6085b01955592f732db6391245bcb6159d0e03315b2c2907f6de5b

    Download Submit

  • /data/data/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    64KB

    MD5

    d66a986126aa432d0238743d63da7fff

    SHA1

    998b7b2efb9d2642905157dd4fe9262fc47852d6

    SHA256

    ecfd243589d7d07dbdb062ecf0a371217c5147a40d2ba0ed0e62732384304b85

    SHA512

    6cb0ac8bd8d351e64e13db5c7a37c870076d0bbfb66426dac33da7adb7279ef74ab51b612fee0c91f3e8eaeadaa9ff79c25a786be410db3561b4784317bd6ca0

    Download Submit

  • /data/data/com.seminar.goddess/app_DynamicOptDex/oat/Theo.json.cur.prof
    Filesize

    807B

    MD5

    c2c8136d62aa66b2072332d63354f11e

    SHA1

    36042856f3af40fc3febdd794f06bdd629eaef50

    SHA256

    b5cc0ffe624648209d8c1a9e68890095782a2d5f875fca16ce1159027c9cf422

    SHA512

    0cd5b4d5d7b7ed5bcb783b8261a6e5d45c31ec623ad36a94a7c063b13c2d6e7abf5b2c55cc644a8d32663b0009ec053906f2195d7202c7090c4109429ff50b93

    Download Submit

  • /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    125KB

    MD5

    9c813978fc696f2fe9c89e30e3d5f753

    SHA1

    877b6dbd2c300c4abe50685d3dff28a8df5a0480

    SHA256

    bf32ef483997f8302194a9b3ae91f76621f0c5c3f9e31d33e950668e0c6ac7eb

    SHA512

    d66950bf635ecad91d796b85abac4cde77f4a2d026d67b5845f92d478b4d55f6a7a9f4af042b76e60f6cab940ed1816a1ae040e13fb07af94f5870d65204b0aa

    Download Submit

  • /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    125KB

    MD5

    6092cd2231b2240ad0c7a40e27f78be4

    SHA1

    cb7da358a44185b821d83985d2e2735a6d82433c

    SHA256

    6eed1a37fafbd5d4966671142703d91950bc065d89e207ac46e21ea95fdd0a9a

    SHA512

    ededc0b10f34490c9ddccd4cefed37afa0850a2fa38ef3f7878090ba4e94b807a737d82d79999024d48dc35644d8153a9f83569bd4357c2cbf4dbf29cf570d81

    Download Submit