Overview

overview

10

Static

static

6

7f0b39cc6a...18.apk

android-9-x86

10

7f0b39cc6a...18.apk

android-10-x64

10

7f0b39cc6a...18.apk

android-11-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f0b39cc6ad10d800d7d5b18f8bd0a99_JaffaCakes118

  • Size

    2.8MB

  • Sample

    240402-a8k5fabg9s

  • MD5

    7f0b39cc6ad10d800d7d5b18f8bd0a99

  • SHA1

    5c4d16375adb8e0fe6b5acbadc59e94b4e31352c

  • SHA256

    e9fc94b9571c7fac6446a5dcef86c8eb7d5318ef4d5783ab387ac805f6c27b4f

  • SHA512

    1c44159e73ef94ee58f32bc1f3164dd048594a224d7c7ea86cf4bc6aa1fb68f84e4035d57eb39c963663ea9cc38f1c6bfa7c05683bd31ff63393a9a88f8e7ae3

  • SSDEEP

    49152:DpV0bxZC0NqMqpEi388PflfkBeHE3/gK0s+sceJjJJCxRQRI6VM+5B:F+b7CY5qts8iBQjKescOJCxRq8y

Score
10/10
cerberusandroidbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://tornacimamutxyz.site

Targets

    • Target

      7f0b39cc6ad10d800d7d5b18f8bd0a99_JaffaCakes118

    • Size

      2.8MB

    • MD5

      7f0b39cc6ad10d800d7d5b18f8bd0a99

    • SHA1

      5c4d16375adb8e0fe6b5acbadc59e94b4e31352c

    • SHA256

      e9fc94b9571c7fac6446a5dcef86c8eb7d5318ef4d5783ab387ac805f6c27b4f

    • SHA512

      1c44159e73ef94ee58f32bc1f3164dd048594a224d7c7ea86cf4bc6aa1fb68f84e4035d57eb39c963663ea9cc38f1c6bfa7c05683bd31ff63393a9a88f8e7ae3

    • SSDEEP

      49152:DpV0bxZC0NqMqpEi388PflfkBeHE3/gK0s+sceJjJJCxRQRI6VM+5B:F+b7CY5qts8iBQjKescOJCxRq8y

    Score
    10/10
    cerberusbankercollectionevasioninfostealerratstealthtrojan

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

      bankertrojaninfostealerevasionratcerberus

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Listens for changes in the sensor environment (might be used to detect emulation)

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks