Analysis
-
max time kernel
59s -
max time network
129s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
01-04-2024 18:52
Static task
static1
Behavioral task
behavioral1
Sample
77b5788f04030d138879e3080e712078_JaffaCakes118.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
77b5788f04030d138879e3080e712078_JaffaCakes118.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
77b5788f04030d138879e3080e712078_JaffaCakes118.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
77b5788f04030d138879e3080e712078_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
77b5788f04030d138879e3080e712078
-
SHA1
880e365f17271d4492f8cca8f86c40835e87fc15
-
SHA256
b08ead4e5ecc18f14e6a92ad09e9ec7dfdfda91d673c0829769f35c76eea2f1b
-
SHA512
ea19c21eddbcbe7bdd3d9fbf0728dc83c0f34a6e30d7227d4d916d0f023007370c38c79bfacb73b6a0102a799a06751364b3c1663818883e2aecd9dcd2c8ec7b
-
SSDEEP
49152:41WqANC++Lf3uXr6xbvCw6iyFj8irzc/tfxqIhQQHOjhDs1:4gdNZ+LM6NvCw6t82c/Pq+YDs1
Malware Config
Extracted
cerberus
http://20.90.106.208/
Signatures
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.polar.mad Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.polar.mad Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.polar.mad -
pid Process 4315 com.polar.mad -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json 4315 com.polar.mad /data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json 4343 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.polar.mad/app_DynamicOptDex/oat/x86/lECnmhp.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json 4315 com.polar.mad -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.polar.mad -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.polar.mad
Processes
-
com.polar.mad1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4315 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.polar.mad/app_DynamicOptDex/oat/x86/lECnmhp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4343
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD510d25aa7eea1091ed36ac3fc44232c80
SHA1ee37b32360f960fd8fc78a737232295e60194296
SHA25604b25eda9c6ff386415a8a09be467d15eaf172d6666aaefab10f306d632b9e3d
SHA51298a815f250248ec28a3bec2b82f552ac647ef24eb5aa522bdf3bc02c8c79af41ba7700adf18b59b23f562e2b1b9b4d4e88ced9d4f8cf0694142911e4808f4e60
-
Filesize
122KB
MD51141f85dce75977878b0915a1a1498d8
SHA16ba93e924febe5d85468737c4d528bc9fcc56839
SHA256b356f9950d1305103221d46862e93344075f9e463e02e1be570f616bd60fc6bc
SHA512beea6e7ee932e324cf2985c5ae4bb78d285fcd843ba7453064931dc546ed2ba631e96253de5438c2d6ed4b6e909f6d6bda562065c895eef93b20cab1fac4a263
-
Filesize
845B
MD5772934dc077736222853b8ad1c605505
SHA1f525cd7a2af9612f54c73c0a26bc5450b434b2c0
SHA256b50c53b663a4be0a7554a9501f41eaf26e59662629d0d03feaa8da27d10b4269
SHA512042278db5cf564a21c851539a61e01d53b284ee8343e3d24015568167607f0ab75bc60e505fa04ba093c3777ba29c85f9a190bb91665671872a216b1c6db9f0c
-
Filesize
122KB
MD5f8cf47ad712b41b0ed676a71a05f7f4a
SHA11020757a92030ce070b0703abfdb6f49d42699b7
SHA25697aa090f01320924d67e6cf540bfe5766e92c104cd477f86dcaf7707933d95b5
SHA51270e3e6e18f9620e16972bd490c93aa8be986e0f9872c073f96ab50fba47609cfda2c7d38485d3b325fa11242243ae752315d29d05e3539fa956700580e6f65bd