Analysis
-
max time kernel
53s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
03-02-2025 22:05
General
-
Target
ccd1678b0b420c42b6ff3d242daa2ff1521b150c1a2d44595b1d3e215076f619.apk
-
Size
1.5MB
-
MD5
585638aa98df44605afadb60932394ea
-
SHA1
a96de3ad7a78dda3af78a1711caaa36760c293d6
-
SHA256
ccd1678b0b420c42b6ff3d242daa2ff1521b150c1a2d44595b1d3e215076f619
-
SHA512
47aa985f80856fa311011e867f6817b21106579812e11c96a41f86107f879895dc50f01270119f29929cfaeba77a5849e9b429e57e8bc68e9623a6b8a9458815
-
SSDEEP
24576:xKQvrlyyfA7xvujMOH+fo0hLYl/qvQtVuxbwtFZ4/AzebPRF2UDG5oMDMuUfi+bv:ooUABHIoriYtHz4/5bP/hDGBwli+z6/e
Malware Config
Extracted
cerberus
http://62.109.13.217/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.despair.lion1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD58a2db94c5ddf8645fc9568b107866b45
SHA13f5f5adefb77cc933873023b45cef84924df2bf8
SHA2567ac2f9a5fa1806d17e8a779350ac613329e995a9bacc593440e410131fa0f433
SHA512bc7811c37a7157ac73de6174b902d554346e372d3d69c39954ec510ecfcaaff599276b071e654d78be60bbe54cd0c279d5e2ade310a5a59e67c9e718f9dbacbb
-
Filesize
64KB
MD5a6c59de661b82991a5ed1e288db89aad
SHA14556c200b94e329fe4805d0eb10054c7118fe0ac
SHA2565cb22f8ed4c46768c1884a9b768aa0caf6ecce35a71c10c7a934eb080a250618
SHA5124006b9b42f0cdaf99460999db834ebb222fe5544e44896f4ceea284313b74f95aace3450cdd54eb11fb7d3bd4a49b48a438d0b688b06549d7a2f21fb59dd7fa1
-
Filesize
186B
MD5e964addc87b1f84109b88e16a9530408
SHA16d45c0c8d4aa542d8cb8fcbfec1c01a6040f6cc7
SHA256afbf1b77538c37242b13f78a18aca5295a56693c8000973c136354c380d13aed
SHA512437a59f90555682ce2159823cb7cd21705d925c5016a8652e1359424dde5a2c8a22a5a1e46160f109939959ce11a466839ac3cd128211a1224925764d83467da
-
Filesize
118KB
MD54c547b8533f6d0c8b84a52f8fbc4ad13
SHA1d8be8c20aca6d7a9348e221ad213555afcddb7e6
SHA25602d27d45c00f8af66aa0137dea77072fba44d0fe2aa6dd7d09106442df9e805d
SHA5126e1de7950ef6df1b0fe088d74b225fed8097abc917bf37ef9305fed5261b3908d3907ce37cd8a0dbb72f7d5e3f4dc231892853914b6077d659fee9d8d9a6f151