Analysis
-
max time kernel
54s -
max time network
143s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
28-01-2025 22:09
General
-
Target
e13976af9c5b0fcf2754484922dd040d3754eb8b07c33c89474352a81a2346c5.apk
-
Size
1.7MB
-
MD5
64930e90e8256f9f1bbedb69bb9e50ee
-
SHA1
173510ac92a5d95b4dfbfe9e79f6e19850b36dec
-
SHA256
e13976af9c5b0fcf2754484922dd040d3754eb8b07c33c89474352a81a2346c5
-
SHA512
50a9d966f170dc9e20d4d105e265bb147184b92517a6c549135c6ec7adb96d48f6fe83b2db50374a6658fcd2b74976852c70cecb3d76ce1e0a86f91eb5966036
-
SSDEEP
49152:HKKgcBrpasMOjcEb8Am/xwA0gbu/NWz/t11SF4FeU3sLZQNT+:HKKgcJwLG8Am2XNWDaLFC+
Malware Config
Extracted
cerberus
http://83.136.233.183/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.bring.tomorrow1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD566ee8a2eabe0c7d433d255d58ad81720
SHA1bacb041a3df0124fd25049a72c06146667cd1e6d
SHA256a1a5ec74e9a28791d5fd9bcdd0021ebcaca3a262bd46e82070fcd5047623b62a
SHA51224ae5e242507a336125268f3a1c37e650a57dbfc1da51f313507273b8b881d64fb4b542267382d0ac27bbe4a304b1943917773ef43cbf92e2ca5e2bfeab69665
-
Filesize
64KB
MD5019fc4a1f264919cb925ec50911bc06c
SHA1c560b4a78faf6f15b69d22a100ba3f0008108920
SHA2567785d4e15b191238eef2bd1f8aaac3c9b776b8c039696093e6576f347bddaa67
SHA51288fb283255564490c661c621554a5f221a88307107e5e7dd42a3a2603994852e604a06fdb36e929aeb700deceb7576a8e047ffe3d6ba13547b7d023941a6647f
-
Filesize
118KB
MD5319edfc7800cd95f601e378877da93dd
SHA148dfc57aab013d0edafe34829dbe91ff7eac0fc6
SHA256633eef55f1182663b9f0cefe056fc85a9fd1c5a4a146201a17677074c10afb85
SHA5127b9de6b544731c3134e40503c73d261c65f0234ae511ba46e3829fa4d836b2d1f993e1082340ba1dcd89c4f1a8d3dd5a5bf83eaf9bf5ad004c0758d80cf7d1f9
-
Filesize
151B
MD5a54bf250c94a10114786a259caa67c47
SHA174fcd093cd5506776a6339ab4cdc8db221d70b2f
SHA2567097164f73bab2c9e434a34c846da6385021961c118143cff10112a9cd0eaad8
SHA512fb43de52302bdaab11f95c2e0ad467bc5e88d49285dca840be9400745a533099a16c3e3cf269aebb5ab0095c762dabe574369b444af4453c751847c4ae010de5