Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

2135231a42...18.apk

android-9-x86

10

2135231a42...18.apk

android-10-x64

10

2135231a42...18.apk

android-11-x64

10

jaxb-api-dexed.apk

android-9-x86

jaxb-api-dexed.apk

android-10-x64

jaxb-api-dexed.apk

android-11-x64

Analysis

  • max time kernel
    40s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    29/03/2024, 11:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2135231a42538e68fa5f23c68ab4d9de_JaffaCakes118.apk

  • Size

    2.2MB

  • MD5

    2135231a42538e68fa5f23c68ab4d9de

  • SHA1

    cdb9753b5f355dc0af80332a83451ec609ccef6f

  • SHA256

    ab5d44f5bf24e5c459088a2ed1469653e7703d133bfab8fa7ec72c0cd91852d0

  • SHA512

    b82ca2d5d1e55f4efdd4a2dd1c31a28b9eb06683e4edc4f0ce2593c7894b0a8a4744cdce53a039d8db6f4eeb73f8e4dd13c233b58613ade5f17a854e1eae9360

  • SSDEEP

    49152:ULfUJngykjQYcykGeOM2EIr6quNl6r+EcNHuCZ1Ol6xdq8oGMst3SFc:ULMJgtjpVktOMXIr6bl6rcOCZ1osd3oq

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://20.90.106.208/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.drop.enjoy
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4375

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.drop.enjoy/app_DynamicOptDex/OTxbFR.json
    Filesize

    122KB

    MD5

    f09d61171ae13baddf641a61f38a3b90

    SHA1

    f45438fe3617626b87450ece5f89cf678dd4daaa

    SHA256

    43b18e7d3ef297ccc15e13789673f0784374f9730b3099a251c58fc7adba6a52

    SHA512

    83a40e8f21677bda4fe12d3fa1122961e7d53486d988ce3be28a50546c3d17c295d860e3fcef36f80da04f7487092e066128d1d6a5adedba02f8fa71649a69dd

    Download Submit

  • /data/user/0/com.drop.enjoy/app_DynamicOptDex/OTxbFR.json
    Filesize

    122KB

    MD5

    1129c4a33d2e2a75a40862258ab980b8

    SHA1

    64950404a3aaa2850412f564e293d628bb037506

    SHA256

    f8d0cdf98bf543c840300d232dc41c85c2b3072c9d4ae0a3865f54e4443ea510

    SHA512

    b4fca6d30bf724a397d75827b6894f7b98010cdd567b906777d8f1a03b22305ee00f896aaf38a90378b97f5877575c02f53569fb01cf2041b446e9cce3ba6f00

    Download Submit