Overview

overview

10

Static

static

6

28e0d06562...18.apk

android-9-x86

10

28e0d06562...18.apk

android-10-x64

10

28e0d06562...18.apk

android-11-x64

Analysis

  • max time kernel
    65s
  • max time network
    158s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    29-03-2024 17:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    28e0d06562a6e0df8dad0fa04e4c33ac_JaffaCakes118.apk

  • Size

    2.7MB

  • MD5

    28e0d06562a6e0df8dad0fa04e4c33ac

  • SHA1

    aa2511f7546d97e327b4a6a027f3195f62e04117

  • SHA256

    aa5ea17832aa74736e26ab68b569c83b38d705289df49bb98c0aa5c9657fbe11

  • SHA512

    946d78b5d85c2fd5c59e5eb406f9bcc99784305a24f416832742049bd7eabe6a3b6d327fcfac6d9d3bf5eaf73490317d1708a54ec2622643a8c9b6f2a1a4b73d

  • SSDEEP

    49152:KmIaOnTtAJESpMYAKueNChLFN1y2uTLsMcd+8ntL/8JnD4FE4Niw1gh05n/6TqM+:xIa4TtAJEvDKueNkzQcd5dIKE4N7gh0D

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

https://232323zonenenmamsmaspacedmmdsmd.space/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.define.cake
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4326
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.define.cake/app_DynamicOptDex/cxlu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.define.cake/app_DynamicOptDex/oat/x86/cxlu.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4353

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.define.cake/app_DynamicOptDex/cxlu.json
    Filesize

    124KB

    MD5

    d638f2bead4b49a71a8ac30d18e48693

    SHA1

    d4fb78822cd773caab6f500e94c95accd6819a9f

    SHA256

    815b82e55881ddbb0d0bc8759cd42eeeb0a7eddeb2d65f5a57695ca3a25a71ed

    SHA512

    a22ff691b85d7755b708c6f7c2f5afdf8e03a550594b84585099d12f2d00d0fd7f5f1f20aef3b08f1ba0e2581649d67fc6e4d359b6f6b8cb6e1c23d659ab1823

    Download Submit

  • /data/data/com.define.cake/app_DynamicOptDex/cxlu.json
    Filesize

    124KB

    MD5

    fb4adcacba26d10255469d87e92b7469

    SHA1

    6e00b9aff113694c27e7d95c35a3b0bbd71a5f3d

    SHA256

    483be7a9079820b2f3e0247363b2d53a5373e6a442d283df28e1dca117163082

    SHA512

    e7f79651153007e7c6c5694d8482628f2b5541771378bcc49b5f8b18b355e170bd480026ee8f1bd428f7b8a2423d72081928f34e256da455066fda6431faee7c

    Download Submit

  • /data/data/com.define.cake/app_DynamicOptDex/oat/cxlu.json.cur.prof
    Filesize

    823B

    MD5

    5b138b37ff32364fe758345b86656a1c

    SHA1

    caf6dbd06bcc09ea698426f9885961e48407724d

    SHA256

    ddb557fea7500e06fec8ccb56262d8296f8232f024cbe95d810e4cee37f575c3

    SHA512

    054d2de06327df179c64f5127442c78195710c587cbeca9aabad3d73f74806973ca437410c28042a60e6e01a35c4883a784a8955cfa8b3fb05d48ce620a013f1

    Download Submit

  • /data/user/0/com.define.cake/app_DynamicOptDex/cxlu.json
    Filesize

    124KB

    MD5

    2fcf61ee9789c63bdafcc566cb55fe9d

    SHA1

    fb420580d48a38d178cd29d49847ef83f5e6b333

    SHA256

    38d6b1a138f90f07526d8778829ebbdf496e05f897ee6ac2733bfca601b48b18

    SHA512

    8a9f80d7ba47c4e51a4342da9c4320bb83bb385e218096a6288d937a5b4463002406cbe0798effb614e5747d4858c52dde26430162d14f2ff311b6576de6b4b5

    Download Submit