Overview

overview

10

Static

static

6

c41fe911cb...18.apk

android-9-x86

10

c41fe911cb...18.apk

android-10-x64

10

c41fe911cb...18.apk

android-11-x64

Analysis

  • max time kernel
    72s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    04-04-2024 23:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c41fe911cb688cfeed73ab07960a7a05_JaffaCakes118.apk

  • Size

    2.9MB

  • MD5

    c41fe911cb688cfeed73ab07960a7a05

  • SHA1

    405fa53700ce104ed339ede1daf49f442945a92d

  • SHA256

    90b4ea5b5b05d0651610e4f07ba3809bfa43a4bee2cd96c5880a63e68fe75840

  • SHA512

    3ebac26fe4c4fddf03b521f80c969f43a07af34d9605263a77948989eac44a571c4a8e50378abeae496490e97bdd2bb2bc0dfb22bc515a4cb501506baa180500

  • SSDEEP

    49152:fd/2ZPtCQShVxqqw4eR4nki0Zpf28+ec3Ep0O9jloXaxmk:V+Z0Q6LqgeRAki0Zt7Tc3Eb5loXaxmk

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://144.91.79.50

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.firm.violin
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.firm.violin/app_DynamicOptDex/BZ.json
    Filesize

    124KB

    MD5

    fd17e60bc6855778a2128564bef469b5

    SHA1

    0090151fa044ef3b240ad27e167d022b402847ca

    SHA256

    fcc2d6977b3f8d318850af160c636b0f3c1eb25a634b54a7e48fd605d686ec21

    SHA512

    a33b33a9d903332a844c1ff0adb87bb7b5ff39ffb13acccb6bb020f42cfad7642691a6f7b384514ff6c1cfae64ea94e0e4a868d02f49fd2be692b114ab9e4abf

    Download Submit
  • /data/data/com.firm.violin/app_DynamicOptDex/BZ.json
    Filesize

    124KB

    MD5

    94bed121a6fdac7af88b5d392c3732ce

    SHA1

    f5ea2dffb750169dd98f4820989d6c852d7b0aaf

    SHA256

    af0e6db3300d0ad15ce9ce0b9c63247ca1c27cebccdf1a0070e457a3ca3de978

    SHA512

    1e0da0a6d9772c8623fe4109ea023d2ef929b11288a3288704c9c27fb1f4012f8cd4a12fd118b46ff3afbac46ad853bd0e2d979db821499de5b882b5299f0f81

    Download Submit
  • /data/data/com.firm.violin/app_DynamicOptDex/oat/BZ.json.cur.prof
    Filesize

    154B

    MD5

    0b7e49c08e41890d49d64560bfb36c2b

    SHA1

    9fc1b52ab593006ca94fced11a8debf1e6bd1d64

    SHA256

    813a81ab1748f213a3cac1c0452335128ce21277daf7f3f5ff587bc339286e3d

    SHA512

    c10685b6f324e6ef30a414c26eeb7d2f3cfdd6f86a5fc08cbea77f93199066f8d5861740351a05e9d167363665694d45c383c8cdedaaa08f89de1f51acb4f8b0

    Download Submit