Overview

overview

10

Static

static

6

8e8b677860...18.apk

android-9-x86

10

8e8b677860...18.apk

android-10-x64

10

8e8b677860...18.apk

android-11-x64

10

Analysis

  • max time kernel
    54s
  • max time network
    136s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    02-04-2024 14:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e8b67786007492adb2f13cb70978ee3_JaffaCakes118.apk

  • Size

    2.7MB

  • MD5

    8e8b67786007492adb2f13cb70978ee3

  • SHA1

    e12e8d2100af4ef4c333081c18777eda783b72fa

  • SHA256

    1b4f0c4cb74737a13cd7c171abfb23b628b68d5a53ab95658d573f11c0a59bd6

  • SHA512

    43bcea92a32858890269b14fbf554980cffd18809994b20e26fad95f6798a22923ba2d04f6a2a8a757d3667527d4a94b7a3440b6bf52e66c580c64912363ae37

  • SSDEEP

    49152:vfL6SRbjiqCkcdp+uQhGTnksk+AKohZLVosriwaTt6ug3Y/64:vf2cjiq5cz+hhGzSBPgwaco5

Score
10/10
cerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://20.90.106.208/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.exhibit.anchor
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4464

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
    Filesize

    122KB

    MD5

    f5c4ed8758f9ad204339c48bdeb39644

    SHA1

    42218fd9f62772d98634cd9bd592edc7b60a72c8

    SHA256

    9692850446b580104fa701969efce73c47b8143ef2716f27091e8bcf4596e754

    SHA512

    0b7dd121f3d31d7f1314e0c29014f9131af6d266d5e0b1e876fca8961c91ae888274dd75e72c24c95fba99c1f8de656e43cf2c70fd21edd826cc3fe7148079a0

    Download Submit

  • /data/user/0/com.exhibit.anchor/app_DynamicOptDex/FCjMq.json
    Filesize

    122KB

    MD5

    ef1c5b2f9ec03596eb1368bf705700c2

    SHA1

    a4e967c58b926e321f6a185ad7c50794be90788a

    SHA256

    8aceed7c6b4962fa92791c484a54baefaa071d81812269dd0132f3a0e25883af

    SHA512

    58fb1ae4516d18540de6ebae340a59edb3fde454ab5926b3c8e86a9ccc961d73f6d2273aa9f3a3846d0eff16c75900fa89a438d7fd55a6e1d262121e730e907a

    Download Submit

  • /data/user/0/com.exhibit.anchor/app_DynamicOptDex/oat/FCjMq.json.cur.prof
    Filesize

    168B

    MD5

    eccc93e01015dec013072649dba5d0bf

    SHA1

    f182f627eac6a2e925f6c6ccebd848a8bdbf1582

    SHA256

    982326c09956bccd86da12ff159bd6e7249f4f059f3d508bd7ed4b39134be1df

    SHA512

    1dec2be77e240e7c6e4b733757d78c9270b7af05f23280c8e998ed48b06996574db2f0adb49d8d2ee404dcce40ee48a1719ae220d188205dc259f96d1f525499

    Download Submit