Analysis
-
max time kernel
40s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
04/03/2025, 22:04
General
-
Target
660286d120f2f0335648ca4ada8cec297a4a95597bc7f9b80f05e9c86fad4a81.apk
-
Size
1.6MB
-
MD5
8b411e4c0aa540005d3f8b40e276f444
-
SHA1
d6a203cb5177f886ef838ee6b72e4341673e9b4e
-
SHA256
660286d120f2f0335648ca4ada8cec297a4a95597bc7f9b80f05e9c86fad4a81
-
SHA512
db8d183f0de54d51b6214e9a75cca6e364cd511cb0a124aafae19ded2f80824a361c62c652d4290a2a3fd5e20b9fdf4e72624885d0fcdbd9ad6638065defafd4
-
SSDEEP
49152:Bu6JIx4h3cf4ga3n0ifQyh8OqCCumKlLHE:X6a3cf6/CumYLE
Malware Config
Extracted
cerberus
http://83.136.233.183/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.chest.dish1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ecd9a435e6676cc8556c633b75e1a4b7
SHA150abc724fbe708092ce34877050444ce5ae7e07c
SHA256d939d97f0093ab0837ca3b0527b7c7705e0a1eea8e41ed3917fd627dab0f6856
SHA51234790fa21f1420d3b4e0b8675917a3cb7b595fcaf4d9d7e52105b46940e5c496ed893e558de055e7f751c399ec30e597e76f9a6e5491191f0032e194abdd256e
-
Filesize
64KB
MD550e789455231bb888034e3648f52444e
SHA18ba67372f1d9ac156399a7c0e758894aec8d958a
SHA256ffef92c66642ba8a1786e1927d222ff369d3a5d0b55e6d2f15c0e99ca4404dc6
SHA5120e12b5a13d8a7e8872a9b4ca8a8ebd48646f5a1418faf25dcd1eca5987816566c1b160f39eaf2d41929eed758f7ff8d9e85f24ad7f5ffe00cfa424c03b28edca
-
Filesize
118KB
MD5319edfc7800cd95f601e378877da93dd
SHA148dfc57aab013d0edafe34829dbe91ff7eac0fc6
SHA256633eef55f1182663b9f0cefe056fc85a9fd1c5a4a146201a17677074c10afb85
SHA5127b9de6b544731c3134e40503c73d261c65f0234ae511ba46e3829fa4d836b2d1f993e1082340ba1dcd89c4f1a8d3dd5a5bf83eaf9bf5ad004c0758d80cf7d1f9