Overview

overview

10

Static

static

6

7f0b39cc6a...18.apk

android-9-x86

10

7f0b39cc6a...18.apk

android-10-x64

10

7f0b39cc6a...18.apk

android-11-x64

Analysis

  • max time kernel
    67s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    02-04-2024 00:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f0b39cc6ad10d800d7d5b18f8bd0a99_JaffaCakes118.apk

  • Size

    2.8MB

  • MD5

    7f0b39cc6ad10d800d7d5b18f8bd0a99

  • SHA1

    5c4d16375adb8e0fe6b5acbadc59e94b4e31352c

  • SHA256

    e9fc94b9571c7fac6446a5dcef86c8eb7d5318ef4d5783ab387ac805f6c27b4f

  • SHA512

    1c44159e73ef94ee58f32bc1f3164dd048594a224d7c7ea86cf4bc6aa1fb68f84e4035d57eb39c963663ea9cc38f1c6bfa7c05683bd31ff63393a9a88f8e7ae3

  • SSDEEP

    49152:DpV0bxZC0NqMqpEi388PflfkBeHE3/gK0s+sceJjJJCxRQRI6VM+5B:F+b7CY5qts8iBQjKescOJCxRq8y

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://tornacimamutxyz.site

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.angry.seek
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4206
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.angry.seek/app_DynamicOptDex/lTUETkY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.angry.seek/app_DynamicOptDex/oat/x86/lTUETkY.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4263

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.angry.seek/app_DynamicOptDex/lTUETkY.json
    Filesize

    124KB

    MD5

    dece0b9285a7f4adb9cc223694094cc4

    SHA1

    c4ce8be5cede385d8faaf792709bbef710b74ee9

    SHA256

    295fd8a61f3123b87585f2c97bde12e86fb51944dac84483efbafd7a6dc6bc61

    SHA512

    9606399a9025570bfcd0030c49d3ffa1dcfeb1855d340629c767f1c16cec1815ca61ca2bb8ff15f31c2ba53288c920f3185c274aa020c6e28ce394c623a2199d

    Download Submit
  • /data/data/com.angry.seek/app_DynamicOptDex/lTUETkY.json
    Filesize

    124KB

    MD5

    faf6fcc1b97ddc80a96cc11452bd7ecd

    SHA1

    4cb2150f0cd2119f24f627b90c69154eef1c4c9e

    SHA256

    4a5db1a3884f8b545f3e5a24a15f49926d7f33a19b75416f512f31b395ec5aaf

    SHA512

    4f371308f21b16398757495de18464fa19193343f60d1b75d743ab216d30a6a5c7961b39cded2465c5cdcf51c5ee4ea9719e865514e3de3a4cdbd1fcdaf8c75c

    Download Submit
  • /data/data/com.angry.seek/app_DynamicOptDex/oat/lTUETkY.json.cur.prof
    Filesize

    833B

    MD5

    93c74dfe1cd9eb2a92d2b4e41267d3be

    SHA1

    66ecde68797d3ae1fff88e1d0087f14db1442613

    SHA256

    f420889e5ddf422520554cee7ba3013e117aa2dbd0bfb2c7886618511551a440

    SHA512

    3b629d15d2eb9845755ec4a08a92d92c528c715b6ac8c72aee4036f3ae7003b7a78249e93b19eb8702fb7d0a9e890c6b05ecb9a5082cda0c20f5f929b8911d8d

    Download Submit
  • /data/user/0/com.angry.seek/app_DynamicOptDex/lTUETkY.json
    Filesize

    124KB

    MD5

    e6524f5371976b92309e86f1feb63cb1

    SHA1

    ce4f876cbb9f8a9ec5c0bf7d5cbd4e6482296a03

    SHA256

    fdd88ac60ede154fafccb76cbaeba36fe6adb48ad888cb637e809e6c52ad37ee

    SHA512

    2e67612425081326cebeaf12ed884578fdc9740ecd7c9fd7ee14cd074211702cfc4cb11b697b8f323567eb6a729c14c2f773f08b271cda269344b65d7caba78d

    Download Submit