Overview

overview

10

Static

static

6

45f493e525...18.apk

android-9-x86

10

45f493e525...18.apk

android-10-x64

10

45f493e525...18.apk

android-11-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    30/03/2024, 22:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    45f493e525bbe41865d76d3f60d22bde_JaffaCakes118.apk

  • Size

    2.5MB

  • MD5

    45f493e525bbe41865d76d3f60d22bde

  • SHA1

    32a1fb26ef90f64411cc25d30a868933c8c56597

  • SHA256

    6208a4c0def1a46852a98bdd37621568ef64be7498d50a7f132faa422ec4c68b

  • SHA512

    f6bf56e1a8a2017d745f07f8b6697d470dba8b64a81fae62000ec9fe474bea117a45db4b2b2dc0b3245b1b035ddc878360326deb16392b9dfd4009ed33005712

  • SSDEEP

    49152:NhpWv0OvsuOV8H6SfYjoj0v9riRKbNRjQjXL8GarkiZb:NhAPi8HlQjPi6RIL8GUkiZb

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://51.132.252.42/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.enlist.scatter
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4606

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/user/0/com.enlist.scatter/app_DynamicOptDex/oat/xaJetlG.json.cur.prof
          Filesize

          177B

          MD5

          5e3d494e228ef1c295f4900af01b5d44

          SHA1

          874f9cba781a5e89766287ba8de5bedf11f19fd1

          SHA256

          e09c263b2235fd9662584686c38d2a1214df2e2483497ce22658fbbbc6847b99

          SHA512

          7aadd2c51e221aa0cf3d937ca59834228dfb63adf6de0de2739fe0838467f29fdc9e8df824477f7cb00eea4ba5afbdeb0c6b96e1b8c78e96a2c4eeb1a19413e1

          Download Submit

        • /data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
          Filesize

          119KB

          MD5

          df12f4f43e7d8b306fc74323b93ce1c9

          SHA1

          4ff0e550885d803f03585ab2c4fe708882f8652a

          SHA256

          0ffc884de89ed7fb976d19b452375b9af90a9a4565db3f18c7d0c079c59c879d

          SHA512

          7da67ca56bad0f1daaa526d8dbdae40c0a24524d3718a9c4cdae3d73acb480fa7d9e4bc17ff4239060436819e280f70a24771a017a8c6282d0a08664c227fa91

          Download Submit

        • /data/user/0/com.enlist.scatter/app_DynamicOptDex/xaJetlG.json
          Filesize

          119KB

          MD5

          c0bd3ca742af2bd903c0a7a032323e89

          SHA1

          892f8dfef740d2c50a42c1e1aaf683a83087b7ec

          SHA256

          32e7e25d2484d0dfd9f1b211c0617d170d630d33a3a7343de4623e2002d60cde

          SHA512

          c07c2f534a1c1923d051b4c0f376b24135ccc597df0a368daeb2d347cfeb870acdd051ceb93cba2556844f1b3f758a4a46c908a469d01cac55d81806fd104988

          Download Submit