Analysis
-
max time kernel
37s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21/02/2025, 22:03
General
-
Target
5b78294af5610e0648f99d2eaeff7b01f50995164fc42770c8f31c46e1cf5e70.apk
-
Size
1.5MB
-
MD5
982274483091aba602bebc749725dc4a
-
SHA1
e47f5c0e435a8d5869c7e479a12f71447ca9a37e
-
SHA256
5b78294af5610e0648f99d2eaeff7b01f50995164fc42770c8f31c46e1cf5e70
-
SHA512
2766693c1b31f4c28d0ce8d967f366e956f0564e78019a2546066b7b8d0c15fdf07873391034003127a2e86c4e013f2b8d13166284be92665214118e8603d359
-
SSDEEP
24576:Unqy7Vn+zDEZJ8P66UBBNDvCk/wGYDfO0emGU4M/M4ozCqx3oDXSpLB4y3DASGCw:Uqy7VoEZSP6vFBwHDfOAG0EvCq1DL3B+
Malware Config
Extracted
cerberus
http://188.120.225.180/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.giggle.one1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5fc92684a265cf1dc4a1404972aa4c67a
SHA1c14b166b71182a2532f45dd974a436955215182e
SHA256a868ffaea5a809293f274b94f04dd23df27dc77664ae9560ba6a306dd8066808
SHA512dbc65189c28f8470adadac273d8d76e873f5be33b8e8866bee2818815ebb45e6466e3d76fa34c7cf3ce39df3c0811f28abafc995b4dc32dff44124d9f50dc69d
-
Filesize
64KB
MD5053e6c09a3cd3e4f6615fdddbc5a7bb0
SHA11e33c204beab616332058edd3245fa183e3981d6
SHA256b6f9039a70d51fe84272575306e32a09dbeda63dc64fd696d546b0b55fcfbb90
SHA512de43b5025b1e52cf27f86236ea55869740ee1da7b23a5ca8646ce5e25ec1f321803318256f82c54c364bb0a829e667c919bbd3191256dfe97456a80b8f28913e
-
Filesize
118KB
MD5db06c1ec59829a13509af9b81aa47881
SHA11fc471dd01410676aac988badab9e636b9948f2b
SHA25681ed5dbd3f672f61f1b04d96b413cc4a0406572427dc88356f6be5ba15f65cdc
SHA51245dec5a2124e30a63f672fd047a66b6d47537cebc964ec5f6939fe1c9636ff569151a0f03ae43b8b3f427bb3331ce309c4effa160249b852a538817e69fb6132