Overview

overview

10

Static

static

6

1cf421285b...18.apk

android-9-x86

10

1cf421285b...18.apk

android-10-x64

10

1cf421285b...18.apk

android-11-x64

Analysis

  • max time kernel
    48s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    29-03-2024 08:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1cf421285b8999a9bf72dabe19d67027_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    1cf421285b8999a9bf72dabe19d67027

  • SHA1

    b49489c238f0126a1ac0f78ac7752f3e185787bc

  • SHA256

    102508ca812d1c70e1ce8cb1c28ff5ef4b14716341ed6813f03cf84330cb76f1

  • SHA512

    a97cadd1f961187823a255a113f90a35f62966c8765fe417e2aaf57d34ea5f89d0d5662655ed18f12a7ccd39e9951f3963b9048525650230c4bf28b9a7cde0a6

  • SSDEEP

    49152:nYgunFOFYVuZumJS8kXI6dkX1vvWurD6giDCg/OL6SRQc9Q0gGy1:YgweYVmnYLI6Q3/rmgiB22SR/5gGy1

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://161.97.187.209

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.near.swing
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4189

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.near.swing/app_DynamicOptDex/icxADyZ.json
    Filesize

    124KB

    MD5

    275d47d84366ca7b5c465e8437437273

    SHA1

    6222aa41910a97426e9bb3091ac0e5c06a2a0512

    SHA256

    559cf368f759a3295d30297a28580e43051fad22b45248b0d10d4116708bda59

    SHA512

    b83df88d9252160c76fcd738d87618c24a39c1a240838e4251eb9390f4cd2e9be1980e5681010e9545e92ccb2129b686d13c68a5aa7a736703258eda824187fc

    Download Submit

  • /data/data/com.near.swing/app_DynamicOptDex/icxADyZ.json
    Filesize

    124KB

    MD5

    44649c58cb4c6a5af17926716392b16d

    SHA1

    72acc848a4777bdfda19ec605b9320ed51dff113

    SHA256

    043319775a555f2026b96e064ce091255ead5f7066e112dcbe9b0fd032ccf4bc

    SHA512

    a6988390fda839aa266bdb0a1b6883924a564d3971859b844ce9f3d255c92695c747fd9f3b7eb5b6885dec90c1365878964eb154d045c37a1ccc7bc77fdf2c17

    Download Submit

  • /data/data/com.near.swing/app_DynamicOptDex/oat/icxADyZ.json.cur.prof
    Filesize

    210B

    MD5

    cb6cd651eb93b997b1103f1a34a288aa

    SHA1

    e878ef97d1a4562c4f8699532d6ac80e39e39b77

    SHA256

    c9187cd7039f5e87918eeb2d71564c48c12525a3fefdae6f48a0838b2243bd68

    SHA512

    b32447829bd22867bd101723ffb0d0ecd1bb242c4ed35ae96208ed4971a0cdea718b27e46e766b2b2ce30b6abdac2ebbc141d2af35950dde60565148f5ab5e6b

    Download Submit