Analysis
-
max time kernel
55s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
04-04-2024 22:26
General
-
Target
c355069aa66854eedfe1ceb5c835afc8_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
c355069aa66854eedfe1ceb5c835afc8
-
SHA1
1c92c43eb06250a3d22e36822ece3f937cbcde65
-
SHA256
5fe4ab4e8f4c83190d48c2f04828b54c2a69c793999c9232594450d21771a5cd
-
SHA512
c10f00a0e6f3ca6aa5f8bbc3024d07fb547bb095a8a6f8011e9a7cf655b2cbcd7f48225332fb1ec22fda09d108de1e52aaf43c370dca0425e8c20e2bae780c96
-
SSDEEP
49152:VaqQs8YjVKs+BFFcfLa3viDyrrlGlJyde7s/YWztLU8tqhHysrZMOdCy:rQZeKswELafiG3IlJyde7CXLpW/ZMOcy
Malware Config
Extracted
cerberus
http://20.90.186.236
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.glide.wise1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD51747b20774698e7e687ba73aa5b8f8df
SHA17dbbe19961c4b27a8b925bfb5902186d3112507f
SHA2561315f0f057d3067ea06202782b1899f058992177722f6308d9ae5c0329202131
SHA512a21e1f048d971709b332f50747d44b66b349216403e8eadacab472d6dd326ae18a8c4b23a460def684152b3422940153bb6c4e28a94be3c9ebf9584e0fad92eb
-
Filesize
119KB
MD5c6cb9f120fc8c93ea20d75aeb7fce973
SHA1909badb6e4a640eb29fbd05dfd2945c8d3aa3291
SHA25618552d71e8a1def005b502cdde5640133814becfd8aaf13d9ab97b66aba1d900
SHA5121657897bd6e7cd592cb01fd7d799e82f180bc27411e1b2bdb1652bbacdf59bd508f60e055063cd3a7f6bd361f7cbf168da8848ac344440529300493233510c9b
-
Filesize
167B
MD5a8579e71916afb5673007f5cd3c7b293
SHA164873ad9c5c15d902be7d11f37c6e1938d985d20
SHA256951420becf96145368964ba55bedd26e2a054c0d51562bee4f1ca117ebaa0021
SHA512dbec71b15fa595f2a9d2d61ae0c5c159e6492ce46e48edca30d33667b9fa37e136051feab31a48f62d0c3fac860682e2e7d31fd412096e4185e38067e82e33ba