Analysis
-
max time kernel
47s -
max time network
160s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
02/02/2025, 22:01
General
-
Target
9ea364ea16c656f5f6b33caf7ff66f7eb85986afd1d5a34d62c502c9a92e1bba.apk
-
Size
1.6MB
-
MD5
f89ac4860d2ffe3042c9616a1a7af5ec
-
SHA1
e656fba5b05f9cd6f6729c0bbec319054a145e4d
-
SHA256
9ea364ea16c656f5f6b33caf7ff66f7eb85986afd1d5a34d62c502c9a92e1bba
-
SHA512
c5098d3d561f8743f2f8af76244eddb824497920532c12a70b05102c9e91d66222110d4b95d8c6753ca3ab1b31ad43931fd117c516f8b987e5c396c13e4d51ba
-
SSDEEP
49152:mhODCycMLSKdEia8jXHKUPoWjWVkE1+nLb2m:mhEwMLSKdEiNGU41u/2m
Malware Config
Extracted
cerberus
http://188.120.228.245/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.thumb.steak1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5dfe43b3c4abba0af4de298226bba6fdf
SHA12355626c34a53651ae9ff1f454ecad1a9bb30a9a
SHA2567d46e3d3bb30afdc27c7bc4bf72478deaf35f8fc5de4a11da8122b7665ed9ede
SHA51270812280b269e82fe5b2604a7930ed54eaba74f0062be63b6fb9cbea77f2ff96c13e7e90a68834f3ca445ef8deeb6d64e8bce31a6ff9a45a6ee9cbf161af8d7b
-
Filesize
64KB
MD5bdcab3408ec3d18d77c8e8e644c18d81
SHA1d15a339ce65663c5dc60ce1c25a05251dc55e309
SHA256b1fd94a393f7bac600af51008393d4b5e69c6aab96b68b469b87e0204fe06a64
SHA5121565e0735102ed57745c5d9a1851dbc3c5c34940f77a6ed31f7ebf1e65aa967fc86a248231bb55e11f7d8d33e9106541eece155c5be8713f18271c5ac984e740
-
Filesize
64KB
MD57b6d139d72e113b947deb8d6cc7ca65b
SHA101683e2e1ef5bde6dc2a2a1dc737934c7e4d4807
SHA256765fba2b72e2ae6d993c4fcc2104ed6ddb38ef9aa9c940fd29ee09a6affdd9ff
SHA512876c9917437e35ad9117f0359cb083c1f589ee45cbe42000cd05c5ae9f63535a29134a9c1fc8ff474cd6f25ca9f1cbd7c54f5ec8bb713584e07ae6f63f08e10a
-
Filesize
118KB
MD526fa0f83291d4580e90abd9afbe8801f
SHA1909d65523a0ec26f954c90ad99ad32317283b7be
SHA25608a2c2ddeea69bad4702f1ba127c8846ff989cb51b5fc21ee0e71b7df826f64a
SHA5121e0bd965bac4933b5fc85982a4533e8e8ce595469aaef6639d5d63d25bf2e65d367a24023d724f625be2fdc3e9d49107b01ca8fe57791572f24fc3237412164d