Analysis

  • max time kernel
    59s
  • max time network
    129s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    01-04-2024 18:52

General

  • Target

    77b5788f04030d138879e3080e712078_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    77b5788f04030d138879e3080e712078

  • SHA1

    880e365f17271d4492f8cca8f86c40835e87fc15

  • SHA256

    b08ead4e5ecc18f14e6a92ad09e9ec7dfdfda91d673c0829769f35c76eea2f1b

  • SHA512

    ea19c21eddbcbe7bdd3d9fbf0728dc83c0f34a6e30d7227d4d916d0f023007370c38c79bfacb73b6a0102a799a06751364b3c1663818883e2aecd9dcd2c8ec7b

  • SSDEEP

    49152:41WqANC++Lf3uXr6xbvCw6iyFj8irzc/tfxqIhQQHOjhDs1:4gdNZ+LM6NvCw6t82c/Pq+YDs1

Malware Config

Extracted

Family

cerberus

C2

http://20.90.106.208/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

Processes

  • com.polar.mad
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4315
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.polar.mad/app_DynamicOptDex/oat/x86/lECnmhp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4343

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.polar.mad/app_DynamicOptDex/lECnmhp.json

    Filesize

    122KB

    MD5

    10d25aa7eea1091ed36ac3fc44232c80

    SHA1

    ee37b32360f960fd8fc78a737232295e60194296

    SHA256

    04b25eda9c6ff386415a8a09be467d15eaf172d6666aaefab10f306d632b9e3d

    SHA512

    98a815f250248ec28a3bec2b82f552ac647ef24eb5aa522bdf3bc02c8c79af41ba7700adf18b59b23f562e2b1b9b4d4e88ced9d4f8cf0694142911e4808f4e60

  • /data/data/com.polar.mad/app_DynamicOptDex/lECnmhp.json

    Filesize

    122KB

    MD5

    1141f85dce75977878b0915a1a1498d8

    SHA1

    6ba93e924febe5d85468737c4d528bc9fcc56839

    SHA256

    b356f9950d1305103221d46862e93344075f9e463e02e1be570f616bd60fc6bc

    SHA512

    beea6e7ee932e324cf2985c5ae4bb78d285fcd843ba7453064931dc546ed2ba631e96253de5438c2d6ed4b6e909f6d6bda562065c895eef93b20cab1fac4a263

  • /data/data/com.polar.mad/app_DynamicOptDex/oat/lECnmhp.json.cur.prof

    Filesize

    845B

    MD5

    772934dc077736222853b8ad1c605505

    SHA1

    f525cd7a2af9612f54c73c0a26bc5450b434b2c0

    SHA256

    b50c53b663a4be0a7554a9501f41eaf26e59662629d0d03feaa8da27d10b4269

    SHA512

    042278db5cf564a21c851539a61e01d53b284ee8343e3d24015568167607f0ab75bc60e505fa04ba093c3777ba29c85f9a190bb91665671872a216b1c6db9f0c

  • /data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json

    Filesize

    122KB

    MD5

    f8cf47ad712b41b0ed676a71a05f7f4a

    SHA1

    1020757a92030ce070b0703abfdb6f49d42699b7

    SHA256

    97aa090f01320924d67e6cf540bfe5766e92c104cd477f86dcaf7707933d95b5

    SHA512

    70e3e6e18f9620e16972bd490c93aa8be986e0f9872c073f96ab50fba47609cfda2c7d38485d3b325fa11242243ae752315d29d05e3539fa956700580e6f65bd