Analysis
-
max time kernel
70s -
max time network
170s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
01-04-2024 11:37
General
-
Target
70f36562f58abbdf83212960f304d528_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
70f36562f58abbdf83212960f304d528
-
SHA1
8448de6901e3aa62d9e6b2d59bfc7c2c9c4664b5
-
SHA256
d7480b9bc123f459d8bd1045f2e1d3b26867c39970290f3007d0b8b79cc1908d
-
SHA512
214671b9742aeafa6d72fd2749a9455e4b0c5d7bd851d845fb4114ba5ef09f1e95ba3331ecae046082344767ee186d2b51fd822595e56171d8b763a3d493a7a6
-
SSDEEP
49152:gcNuUEfxWM9GxhjSIQEAOCYMsSsb9wf8UkPW50SHVo/P77RBz/mE3tvf:gcEUDM0hjzQ6CkiGy0Oor7jP9vf
Malware Config
Extracted
cerberus
http://194.163.187.220
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.mammal.shrug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD58ad4d9f1da8e73f998c3695de55b582f
SHA1edaa386221336346a2522f68729666fcf1d3316f
SHA256fc030c124eea710b1a4be9f88a39ba02a38ac12b4ccd576a1e86a344a36c4810
SHA5124783ada0bb35cdd57e8fe817f65b8f53d2477545fc3e5d766cc1977b2984afb2f862ab118fd3e17f9a67ef5e4b49e42b062695ed7c5dabeac4d5a2a6878f0b0f
-
Filesize
124KB
MD56805130b46f02562afbd415b6ea7d6d2
SHA1ad42b3a25b34e0e86d5dab3284b7b224e79378dd
SHA2563e7dd06af175c263157717e16dbbf98ec38eec74e163017eb7fc0af477ae7ce5
SHA5124b3a1f6a410db6fcaec29baa8d3ccf4a731b0949da3d914c0edaf4f89884bb733205de0f1707421d276bfd68342c2e60e1b28d0b87f99b366692860b98d58b61
-
Filesize
806B
MD5b220df0669126a6559cfcad7c766ec67
SHA198d3b8ebc01757d044644d2351aa32ee192b8cad
SHA256f1601a6efa26bb1d58804948f202f3ad1ed809983200485f900e8343d6b07781
SHA512980ffe36ba709cc2f39078b7fe76283c7a0918796d7fc6038ed55cfb64457a2a41cd8a875d2b09ef7c548e8087a1db7460b20b7546c1f038e08d1ea63915a9d9