Analysis
-
max time kernel
52s -
max time network
158s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
17-01-2025 22:01
General
-
Target
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk
-
Size
1.3MB
-
MD5
e7ec59ef18185b1296a71ccc0e77ddcc
-
SHA1
c6a21a11d192b1e11a8d9556aaf1b42bcbfda959
-
SHA256
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136
-
SHA512
2f27d381a7c288cb09177e52c07ff1a1276d929db66ebe95aaff1a42b55eed4b8bbfd5815a887f4b8860c2456ad2f065bd95f379c4ed2e9996539e704cb920f2
-
SSDEEP
24576:CnQQRsClfdZTrGeXKCCdQuKc/XsRN8baXY9c2p5jjpeQqQLTAC+PGZsgK:CnQCXdZ+5xdocEPIc2rBeQqCAC+uZbK
Malware Config
Extracted
cerberus
http://194.34.232.172
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.seminar.goddess1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ed6c57c0e237f9abe38551da30c30817
SHA1cac0e5e44338e615c4784dd7725935a5ccb161f5
SHA2560e62e5afd9a69eda37e1c31dfc139f24fa14be21cc399e1dc3e3cbec0ab8ae91
SHA512f4b7cad3affeb76361bd43461fa19bbf240de2674a89a79437486a258e27b344ae54bb2c1c6085b01955592f732db6391245bcb6159d0e03315b2c2907f6de5b
-
Filesize
64KB
MD5d66a986126aa432d0238743d63da7fff
SHA1998b7b2efb9d2642905157dd4fe9262fc47852d6
SHA256ecfd243589d7d07dbdb062ecf0a371217c5147a40d2ba0ed0e62732384304b85
SHA5126cb0ac8bd8d351e64e13db5c7a37c870076d0bbfb66426dac33da7adb7279ef74ab51b612fee0c91f3e8eaeadaa9ff79c25a786be410db3561b4784317bd6ca0
-
Filesize
177B
MD5a947f3141fece9e0e98cb677a8288f37
SHA1733bf3ac97ff7c9c24b56ad56fc4dba676d27b54
SHA25696e76a8349717deade1de89fd014cf41bf7254f097a328fe8f775707f4b09d71
SHA512a2ad22b9554d54f890ca9db7bd0d61d1218a08dc5711ff36dd80d56986f3a23944db0eed5dc75533969335adeff59b5193645d53746e0089755e7857173efb10
-
Filesize
125KB
MD56092cd2231b2240ad0c7a40e27f78be4
SHA1cb7da358a44185b821d83985d2e2735a6d82433c
SHA2566eed1a37fafbd5d4966671142703d91950bc065d89e207ac46e21ea95fdd0a9a
SHA512ededc0b10f34490c9ddccd4cefed37afa0850a2fa38ef3f7878090ba4e94b807a737d82d79999024d48dc35644d8153a9f83569bd4357c2cbf4dbf29cf570d81