Overview

overview

10

Static

static

6

6f13f461fe...18.apk

android-9-x86

10

6f13f461fe...18.apk

android-10-x64

10

6f13f461fe...18.apk

android-11-x64

10

Analysis

  • max time kernel
    67s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    01-04-2024 10:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f13f461fe2814056f907341fa16ec58_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    6f13f461fe2814056f907341fa16ec58

  • SHA1

    53c176d8c7571c79c9fa3b828d75e6876ba9a7cb

  • SHA256

    cb6a1451efb23dd95bfbe11da3019ad34105ef34572cc0e734dfe1b5ef05c07b

  • SHA512

    70c0a60148c314587b03d80cd4f13b3650375eb5904e26bf7fe40dc68bce3f0c85958ee217ee578ddb6afc9a00407d7321d3a036b12baa73e8fba4aafa0ee7eb

  • SSDEEP

    49152:7jfKzEXM5kU4xKMc0ewjoZlAG6udDW0kOgcG1Rp8FgvO8t5w526z+GmgJFB:7jS0MyU4xHcjRlAG3kOgcubyOxw526Ca

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://20.90.186.236

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.shop.again
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4452

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.shop.again/app_DynamicOptDex/oat/uibOxgM.json.cur.prof
    Filesize

    169B

    MD5

    85d1381ca07f5823ce92f279194af6b2

    SHA1

    56182c5a209b537f5918c6dc69eada150a5d7ee8

    SHA256

    587a4c954732fb1a56bc174d3db23beb90c7a465ec51fbd1fa9d582906dd3267

    SHA512

    1902514e49a3a443a43291b3e68132cf116ef3616c703d75b2565b1bb1a6304db717b96c8f80912a981b8b4f9e36a04787967035a543b66ce817a3633a191828

    Download Submit

  • /data/user/0/com.shop.again/app_DynamicOptDex/uibOxgM.json
    Filesize

    119KB

    MD5

    3ba2c46efc3316f2d6034e9dca938ee8

    SHA1

    9a04a89cde055af842f143fc15eaac9bba219cb8

    SHA256

    79e3c4d80dfc81d9ce22a80e1c5e5b5a67d11f81acdf7de94ecd39c5542f3894

    SHA512

    28b8e84533ecb799e5a6c2efbefe33ffe7c668de86d3e84bfb16be3ef9a720e4ff597f9acf7b8b189a52c09011d3bc1568027b584b2be7fc6fd40de9a3c8be8b

    Download Submit

  • /data/user/0/com.shop.again/app_DynamicOptDex/uibOxgM.json
    Filesize

    119KB

    MD5

    864b1c8f4a56732cb7e2882c0dae943a

    SHA1

    5dd7d3b442a659f8ff94363f34a942e92704fe5a

    SHA256

    5bd2a382ff2b03bae469913dca02714d97c0e2345b9111de2457b0b6113e7a04

    SHA512

    031903bf590f4728d02796fd37c4bf0efb36f8cde31fcc7469e3d3b5703cbd65a7064350d0f04ae7a428a0d8c287528aa046ac425300f1db4e875e86cd44d6a8

    Download Submit