Overview

overview

10

Static

static

6

45f493e525...18.apk

android-9-x86

10

45f493e525...18.apk

android-10-x64

10

45f493e525...18.apk

android-11-x64

10

Analysis

  • max time kernel
    70s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    30/03/2024, 22:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    45f493e525bbe41865d76d3f60d22bde_JaffaCakes118.apk

  • Size

    2.5MB

  • MD5

    45f493e525bbe41865d76d3f60d22bde

  • SHA1

    32a1fb26ef90f64411cc25d30a868933c8c56597

  • SHA256

    6208a4c0def1a46852a98bdd37621568ef64be7498d50a7f132faa422ec4c68b

  • SHA512

    f6bf56e1a8a2017d745f07f8b6697d470dba8b64a81fae62000ec9fe474bea117a45db4b2b2dc0b3245b1b035ddc878360326deb16392b9dfd4009ed33005712

  • SSDEEP

    49152:NhpWv0OvsuOV8H6SfYjoj0v9riRKbNRjQjXL8GarkiZb:NhAPi8HlQjPi6RIL8GUkiZb

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://51.132.252.42/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.enlist.scatter
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4281
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.enlist.scatter/app_DynamicOptDex/oat/x86/xaJetlG.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4308

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.enlist.scatter/app_DynamicOptDex/oat/xaJetlG.json.cur.prof
          Filesize

          814B

          MD5

          4ddfc7d7a25e0bb886d3e1f1390f2ae2

          SHA1

          610f76925dd25ddb8cf1205bcefbc3a70974c1b8

          SHA256

          058d5b71faba00fe9dc280170bfd8436f55bb9f8c796b1dd79833fb46e620148

          SHA512

          de016deba46b8904ba160ed3bfa57eb4ed54f281ae4fa30df96b752b93d22708aa1d7900d73a71986e920a57a782d0f501fc077f1cf17ebabadf81ff52d808e1

          Download Submit

        • /data/data/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
          Filesize

          119KB

          MD5

          df12f4f43e7d8b306fc74323b93ce1c9

          SHA1

          4ff0e550885d803f03585ab2c4fe708882f8652a

          SHA256

          0ffc884de89ed7fb976d19b452375b9af90a9a4565db3f18c7d0c079c59c879d

          SHA512

          7da67ca56bad0f1daaa526d8dbdae40c0a24524d3718a9c4cdae3d73acb480fa7d9e4bc17ff4239060436819e280f70a24771a017a8c6282d0a08664c227fa91

          Download Submit

        • /data/data/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
          Filesize

          119KB

          MD5

          c0bd3ca742af2bd903c0a7a032323e89

          SHA1

          892f8dfef740d2c50a42c1e1aaf683a83087b7ec

          SHA256

          32e7e25d2484d0dfd9f1b211c0617d170d630d33a3a7343de4623e2002d60cde

          SHA512

          c07c2f534a1c1923d051b4c0f376b24135ccc597df0a368daeb2d347cfeb870acdd051ceb93cba2556844f1b3f758a4a46c908a469d01cac55d81806fd104988

          Download Submit

        • /data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
          Filesize

          119KB

          MD5

          f778e89ebadf8779b839b4a9f97c6ad5

          SHA1

          80af3788289544a7f2531acca6a0cdf22a3b6c89

          SHA256

          51f16210853e5c8ced735f882e21d2f191ad347001d8145020f8a8846c9d5433

          SHA512

          49716929677cf279cbe4f0b1b3c5a11b1d474bec0afe3b50147bd681fc1397a9eba199f6d4a4f49e772322513e36b89d67b73e39698235eabfca598b454bfb33

          Download Submit