Overview

overview

10

Static

static

6

8e8b677860...18.apk

android-9-x86

10

8e8b677860...18.apk

android-10-x64

10

8e8b677860...18.apk

android-11-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    02-04-2024 14:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e8b67786007492adb2f13cb70978ee3_JaffaCakes118.apk

  • Size

    2.7MB

  • MD5

    8e8b67786007492adb2f13cb70978ee3

  • SHA1

    e12e8d2100af4ef4c333081c18777eda783b72fa

  • SHA256

    1b4f0c4cb74737a13cd7c171abfb23b628b68d5a53ab95658d573f11c0a59bd6

  • SHA512

    43bcea92a32858890269b14fbf554980cffd18809994b20e26fad95f6798a22923ba2d04f6a2a8a757d3667527d4a94b7a3440b6bf52e66c580c64912363ae37

  • SSDEEP

    49152:vfL6SRbjiqCkcdp+uQhGTnksk+AKohZLVosriwaTt6ug3Y/64:vf2cjiq5cz+hhGzSBPgwaco5

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://20.90.106.208/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.exhibit.anchor
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4210
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exhibit.anchor/app_DynamicOptDex/oat/x86/FCjMq.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4267

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
    Filesize

    122KB

    MD5

    f5c4ed8758f9ad204339c48bdeb39644

    SHA1

    42218fd9f62772d98634cd9bd592edc7b60a72c8

    SHA256

    9692850446b580104fa701969efce73c47b8143ef2716f27091e8bcf4596e754

    SHA512

    0b7dd121f3d31d7f1314e0c29014f9131af6d266d5e0b1e876fca8961c91ae888274dd75e72c24c95fba99c1f8de656e43cf2c70fd21edd826cc3fe7148079a0

    Download Submit

  • /data/data/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
    Filesize

    122KB

    MD5

    ef1c5b2f9ec03596eb1368bf705700c2

    SHA1

    a4e967c58b926e321f6a185ad7c50794be90788a

    SHA256

    8aceed7c6b4962fa92791c484a54baefaa071d81812269dd0132f3a0e25883af

    SHA512

    58fb1ae4516d18540de6ebae340a59edb3fde454ab5926b3c8e86a9ccc961d73f6d2273aa9f3a3846d0eff16c75900fa89a438d7fd55a6e1d262121e730e907a

    Download Submit

  • /data/data/com.exhibit.anchor/app_DynamicOptDex/oat/FCjMq.json.cur.prof
    Filesize

    837B

    MD5

    b1b0bc891a20e87d337fca3b5689aabb

    SHA1

    c1519098acd97b9b7340bda2b76a18adcc8b57c4

    SHA256

    1fbefe2ed8f76a97c467f51a4e0ecef6aaf1d9ced86d025a39f87384a18f1298

    SHA512

    6d25267ed44d80c288229aad91f0608e773f354c088a88b6c0d55f1323162ac5a36f042fd4a040dff9e67d5e4d2f798fb4a4fa984a08570358dffa5433389899

    Download Submit

  • /data/user/0/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
    Filesize

    122KB

    MD5

    e374027bfb8e3fdb4ae0f423175e7a7c

    SHA1

    aacc98bbc396061292f763895ba2642480d061af

    SHA256

    bb8fe3fbd7d53b274ef26caa2b655b1dff48294f8a8c4de7f93c2c6924420cd5

    SHA512

    f6a757e9ee46b5f6f4604e92dddfd20a984915e950a72cf7e7ca5cb8e2354e5ee21e1d5cbe4fe30832a0002193a8ec1e25a2a797c164d281d07bc1477316c2d0

    Download Submit