Analysis
-
max time kernel
66s -
max time network
141s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
29-03-2024 11:49
General
-
Target
2135231a42538e68fa5f23c68ab4d9de_JaffaCakes118.apk
-
Size
2.2MB
-
MD5
2135231a42538e68fa5f23c68ab4d9de
-
SHA1
cdb9753b5f355dc0af80332a83451ec609ccef6f
-
SHA256
ab5d44f5bf24e5c459088a2ed1469653e7703d133bfab8fa7ec72c0cd91852d0
-
SHA512
b82ca2d5d1e55f4efdd4a2dd1c31a28b9eb06683e4edc4f0ce2593c7894b0a8a4744cdce53a039d8db6f4eeb73f8e4dd13c233b58613ade5f17a854e1eae9360
-
SSDEEP
49152:ULfUJngykjQYcykGeOM2EIr6quNl6r+EcNHuCZ1Ol6xdq8oGMst3SFc:ULMJgtjpVktOMXIr6bl6rcOCZ1osd3oq
Malware Config
Extracted
cerberus
http://20.90.106.208/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.drop.enjoy1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.drop.enjoy/app_DynamicOptDex/OTxbFR.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.drop.enjoy/app_DynamicOptDex/oat/x86/OTxbFR.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5f09d61171ae13baddf641a61f38a3b90
SHA1f45438fe3617626b87450ece5f89cf678dd4daaa
SHA25643b18e7d3ef297ccc15e13789673f0784374f9730b3099a251c58fc7adba6a52
SHA51283a40e8f21677bda4fe12d3fa1122961e7d53486d988ce3be28a50546c3d17c295d860e3fcef36f80da04f7487092e066128d1d6a5adedba02f8fa71649a69dd
-
Filesize
122KB
MD51129c4a33d2e2a75a40862258ab980b8
SHA164950404a3aaa2850412f564e293d628bb037506
SHA256f8d0cdf98bf543c840300d232dc41c85c2b3072c9d4ae0a3865f54e4443ea510
SHA512b4fca6d30bf724a397d75827b6894f7b98010cdd567b906777d8f1a03b22305ee00f896aaf38a90378b97f5877575c02f53569fb01cf2041b446e9cce3ba6f00
-
Filesize
830B
MD539471af738fbf080b20a16af1fe3e19a
SHA165b62a965aa523dc238976e8807606670a10ae14
SHA256fc4b828afebf034e47860a11ca1cecff3bb21a14c1ad8c5b40d98fea8a3c5227
SHA5125bb2a60c0498f1c30abdfee18443ef563a3a9a3d73d47390907fe61c5e4992f22810c335dc73a17462e31ecf6db87f878c96a5f31dbff915f378bc3df8bed6ad
-
Filesize
122KB
MD53f41135ccb08d48e349cc6b1c94b3aae
SHA1d920049f95a0f1415e842fd11801a3ab37678e24
SHA25647867768351f4abb246f27fb86a9d7ec24706a9cd032b9644edde0d7c01cbd32
SHA512e5d2073607260272f7c71b05174f8ceef484c9348b3543c829e372be232e2c13a9cc110e39862d50e077cba10ec7f8bfe11c6393f9660eb83be00a5d178d87dc