Analysis
-
max time kernel
69s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
04-04-2024 22:26
General
-
Target
c355069aa66854eedfe1ceb5c835afc8_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
c355069aa66854eedfe1ceb5c835afc8
-
SHA1
1c92c43eb06250a3d22e36822ece3f937cbcde65
-
SHA256
5fe4ab4e8f4c83190d48c2f04828b54c2a69c793999c9232594450d21771a5cd
-
SHA512
c10f00a0e6f3ca6aa5f8bbc3024d07fb547bb095a8a6f8011e9a7cf655b2cbcd7f48225332fb1ec22fda09d108de1e52aaf43c370dca0425e8c20e2bae780c96
-
SSDEEP
49152:VaqQs8YjVKs+BFFcfLa3viDyrrlGlJyde7s/YWztLU8tqhHysrZMOdCy:rQZeKswELafiG3IlJyde7CXLpW/ZMOcy
Malware Config
Extracted
cerberus
http://20.90.186.236
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.glide.wise1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD51747b20774698e7e687ba73aa5b8f8df
SHA17dbbe19961c4b27a8b925bfb5902186d3112507f
SHA2561315f0f057d3067ea06202782b1899f058992177722f6308d9ae5c0329202131
SHA512a21e1f048d971709b332f50747d44b66b349216403e8eadacab472d6dd326ae18a8c4b23a460def684152b3422940153bb6c4e28a94be3c9ebf9584e0fad92eb
-
Filesize
119KB
MD5c6cb9f120fc8c93ea20d75aeb7fce973
SHA1909badb6e4a640eb29fbd05dfd2945c8d3aa3291
SHA25618552d71e8a1def005b502cdde5640133814becfd8aaf13d9ab97b66aba1d900
SHA5121657897bd6e7cd592cb01fd7d799e82f180bc27411e1b2bdb1652bbacdf59bd508f60e055063cd3a7f6bd361f7cbf168da8848ac344440529300493233510c9b
-
Filesize
218B
MD577e53f2a0e28e360ff4d112385bda625
SHA1f6f88e377aa4ea177e7130759ee3708beaa9693e
SHA256c6c9727a622153796f3feb02b8da13900cec96309e9e9a28a7167ce8d38de018
SHA512fcb15efc2a00813deedc15dafcf5a5981f9f8e300df35d71f7219ca9e765e9e05e6d7888929f71c095801c404d689d4ba5c1f42b8b27f822942867aa1ab06959