Analysis
-
max time kernel
53s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27/03/2025, 21:01
General
-
Target
ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c.apk
-
Size
1.1MB
-
MD5
1512c3fa688ca107784b3c93cd9f3526
-
SHA1
4140c53e9c5b6215cc9706ba53def170858e7f9b
-
SHA256
ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c
-
SHA512
417bc07d7486135338b0a6374bc73894ddbbfefee0163cd47e73c01a0217af2e3cbb658d8621c1accc685caa491d8a5c31f10c3ed6b0391c65761b4d55d06021
-
SSDEEP
24576:YpzErttEp6VcY3BX5xBay1hgZlc1tpZgoOZgoOZgoOZgo0I:azMbpNJxB11iZS1jSRSRSRSpI
Malware Config
Extracted
cerberus
http://94.156.77.32
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mwmnfwt.arhkrgajn1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD54b2132b2f14d5bef6b55191fe0a01c76
SHA162ecfd6921cb6511a7d2966c6a0790bfef2de7e2
SHA256ba79058d13969080a465c6fb96ae10fd852b32905f965f4d46672b2304098005
SHA512be918462691168c949b58691d6cc498b6988eb67a5386f60ae74f8453440db5601638bd4753ccf3e45200c5821e74f1ee13c6c63f5938f8c2821a3c8fb066228
-
Filesize
190B
MD56cc9017c011d7db5d3b8c2effdafe766
SHA1914c8ffb50737330a943cc1bdbd9b076ef92a17d
SHA256d4a84da47e16676b928f54d94706b62c2fe98603d7d75405c9b33da715e48ce9
SHA5120092c58aad9ff96b8a1b721a9713256f21443c485d94a992f8002d8aec2715d4ba746897c1cbd260c5d8dea7774ebc303fcb8312c1a500476230026c8a2bd0af
-
Filesize
122KB
MD592465828e13b365caa16c90349448d4e
SHA152f28a05d1b61a9d99e3c821bc82d98ce7547f46
SHA256ba5d352db34f86c20c2bf9a0a1458364bfb105b9dbfd5e9b489ee9d3ed3993ec
SHA512762d3aae0b04ecbd33766cd3469a5a8a69d8366fb85477e25d9d59f0f8dd4b229cd7b3fb806108e1560ea808f9f694fad345d8d31b93f588745969fe5cb6febc