Overview

overview

10

Static

static

6

6f13f461fe...18.apk

android-9-x86

10

6f13f461fe...18.apk

android-10-x64

10

6f13f461fe...18.apk

android-11-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    01-04-2024 10:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f13f461fe2814056f907341fa16ec58_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    6f13f461fe2814056f907341fa16ec58

  • SHA1

    53c176d8c7571c79c9fa3b828d75e6876ba9a7cb

  • SHA256

    cb6a1451efb23dd95bfbe11da3019ad34105ef34572cc0e734dfe1b5ef05c07b

  • SHA512

    70c0a60148c314587b03d80cd4f13b3650375eb5904e26bf7fe40dc68bce3f0c85958ee217ee578ddb6afc9a00407d7321d3a036b12baa73e8fba4aafa0ee7eb

  • SSDEEP

    49152:7jfKzEXM5kU4xKMc0ewjoZlAG6udDW0kOgcG1Rp8FgvO8t5w526z+GmgJFB:7jS0MyU4xHcjRlAG3kOgcubyOxw526Ca

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://20.90.186.236

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.shop.again
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4190

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.shop.again/app_DynamicOptDex/oat/uibOxgM.json.cur.prof
    Filesize

    211B

    MD5

    c8ea4429e55078ee720d76d622d746b9

    SHA1

    8dbc4f87867a61db1c9a6d76ca16841f0c0134a1

    SHA256

    aede2a5df3c1a2548e6933bad08f097b9690201ebaa5239f93ad23159c38d868

    SHA512

    2f52fb974ec4dc3b90fe476d986765a8c569734263edefa888290258768f523fd8aa049e981a2d05997b0382c228468a8adf1dd7e7c9c5322b2f34691f0c115f

    Download Submit

  • /data/data/com.shop.again/app_DynamicOptDex/uibOxgM.json
    Filesize

    119KB

    MD5

    3ba2c46efc3316f2d6034e9dca938ee8

    SHA1

    9a04a89cde055af842f143fc15eaac9bba219cb8

    SHA256

    79e3c4d80dfc81d9ce22a80e1c5e5b5a67d11f81acdf7de94ecd39c5542f3894

    SHA512

    28b8e84533ecb799e5a6c2efbefe33ffe7c668de86d3e84bfb16be3ef9a720e4ff597f9acf7b8b189a52c09011d3bc1568027b584b2be7fc6fd40de9a3c8be8b

    Download Submit

  • /data/data/com.shop.again/app_DynamicOptDex/uibOxgM.json
    Filesize

    119KB

    MD5

    864b1c8f4a56732cb7e2882c0dae943a

    SHA1

    5dd7d3b442a659f8ff94363f34a942e92704fe5a

    SHA256

    5bd2a382ff2b03bae469913dca02714d97c0e2345b9111de2457b0b6113e7a04

    SHA512

    031903bf590f4728d02796fd37c4bf0efb36f8cde31fcc7469e3d3b5703cbd65a7064350d0f04ae7a428a0d8c287528aa046ac425300f1db4e875e86cd44d6a8

    Download Submit