Overview

overview

10

Static

static

6

c41fe911cb...18.apk

android-9-x86

10

c41fe911cb...18.apk

android-10-x64

10

c41fe911cb...18.apk

android-11-x64

Analysis

  • max time kernel
    71s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    04-04-2024 23:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c41fe911cb688cfeed73ab07960a7a05_JaffaCakes118.apk

  • Size

    2.9MB

  • MD5

    c41fe911cb688cfeed73ab07960a7a05

  • SHA1

    405fa53700ce104ed339ede1daf49f442945a92d

  • SHA256

    90b4ea5b5b05d0651610e4f07ba3809bfa43a4bee2cd96c5880a63e68fe75840

  • SHA512

    3ebac26fe4c4fddf03b521f80c969f43a07af34d9605263a77948989eac44a571c4a8e50378abeae496490e97bdd2bb2bc0dfb22bc515a4cb501506baa180500

  • SSDEEP

    49152:fd/2ZPtCQShVxqqw4eR4nki0Zpf28+ec3Ep0O9jloXaxmk:V+Z0Q6LqgeRAki0Zt7Tc3Eb5loXaxmk

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://144.91.79.50

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.firm.violin
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4211
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.firm.violin/app_DynamicOptDex/BZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.firm.violin/app_DynamicOptDex/oat/x86/BZ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4259

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.firm.violin/app_DynamicOptDex/BZ.json
    Filesize

    124KB

    MD5

    fd17e60bc6855778a2128564bef469b5

    SHA1

    0090151fa044ef3b240ad27e167d022b402847ca

    SHA256

    fcc2d6977b3f8d318850af160c636b0f3c1eb25a634b54a7e48fd605d686ec21

    SHA512

    a33b33a9d903332a844c1ff0adb87bb7b5ff39ffb13acccb6bb020f42cfad7642691a6f7b384514ff6c1cfae64ea94e0e4a868d02f49fd2be692b114ab9e4abf

    Download Submit
  • /data/data/com.firm.violin/app_DynamicOptDex/BZ.json
    Filesize

    124KB

    MD5

    94bed121a6fdac7af88b5d392c3732ce

    SHA1

    f5ea2dffb750169dd98f4820989d6c852d7b0aaf

    SHA256

    af0e6db3300d0ad15ce9ce0b9c63247ca1c27cebccdf1a0070e457a3ca3de978

    SHA512

    1e0da0a6d9772c8623fe4109ea023d2ef929b11288a3288704c9c27fb1f4012f8cd4a12fd118b46ff3afbac46ad853bd0e2d979db821499de5b882b5299f0f81

    Download Submit
  • /data/data/com.firm.violin/app_DynamicOptDex/oat/BZ.json.cur.prof
    Filesize

    815B

    MD5

    56960f2064b2d8ca11f5d5a4986ea290

    SHA1

    dcb4ab01aff1b6d052b9412e1efd59a0964cde78

    SHA256

    2b02b1f03f829506b2d765ab31156760b9bec3cd964dc026b234ebbd54043eab

    SHA512

    223517e5397bc30c916b5ea94b9796def89c130769a05af1ff65a47a91b3ba8a10bce6b737fea2d7515e02e619b3c94c13370da8235ca70d8c0e39dadc384728

    Download Submit
  • /data/user/0/com.firm.violin/app_DynamicOptDex/BZ.json
    Filesize

    124KB

    MD5

    1c74cb5b76a733fd0370e1a30a4e0107

    SHA1

    e4c8325d6b77b66ec958ee12e873e01c42905867

    SHA256

    5524216bfdd34a249d4b896acbceb6e40b827b227797d0cff9129f119a6386d7

    SHA512

    032b2281aa60bd41be091fa85d66928acbd67bf23b421f25384bae569d806ab573cca61fa00e9deaa0f8a0d4e62dd2d5cc671f95c90c2f46ee7627eaf016f954

    Download Submit