Analysis
-
max time kernel
72s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
04-04-2024 23:02
General
-
Target
c41fe911cb688cfeed73ab07960a7a05_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
c41fe911cb688cfeed73ab07960a7a05
-
SHA1
405fa53700ce104ed339ede1daf49f442945a92d
-
SHA256
90b4ea5b5b05d0651610e4f07ba3809bfa43a4bee2cd96c5880a63e68fe75840
-
SHA512
3ebac26fe4c4fddf03b521f80c969f43a07af34d9605263a77948989eac44a571c4a8e50378abeae496490e97bdd2bb2bc0dfb22bc515a4cb501506baa180500
-
SSDEEP
49152:fd/2ZPtCQShVxqqw4eR4nki0Zpf28+ec3Ep0O9jloXaxmk:V+Z0Q6LqgeRAki0Zt7Tc3Eb5loXaxmk
Malware Config
Extracted
cerberus
http://144.91.79.50
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.firm.violin1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5fd17e60bc6855778a2128564bef469b5
SHA10090151fa044ef3b240ad27e167d022b402847ca
SHA256fcc2d6977b3f8d318850af160c636b0f3c1eb25a634b54a7e48fd605d686ec21
SHA512a33b33a9d903332a844c1ff0adb87bb7b5ff39ffb13acccb6bb020f42cfad7642691a6f7b384514ff6c1cfae64ea94e0e4a868d02f49fd2be692b114ab9e4abf
-
Filesize
124KB
MD594bed121a6fdac7af88b5d392c3732ce
SHA1f5ea2dffb750169dd98f4820989d6c852d7b0aaf
SHA256af0e6db3300d0ad15ce9ce0b9c63247ca1c27cebccdf1a0070e457a3ca3de978
SHA5121e0da0a6d9772c8623fe4109ea023d2ef929b11288a3288704c9c27fb1f4012f8cd4a12fd118b46ff3afbac46ad853bd0e2d979db821499de5b882b5299f0f81
-
Filesize
154B
MD50b7e49c08e41890d49d64560bfb36c2b
SHA19fc1b52ab593006ca94fced11a8debf1e6bd1d64
SHA256813a81ab1748f213a3cac1c0452335128ce21277daf7f3f5ff587bc339286e3d
SHA512c10685b6f324e6ef30a414c26eeb7d2f3cfdd6f86a5fc08cbea77f93199066f8d5861740351a05e9d167363665694d45c383c8cdedaaa08f89de1f51acb4f8b0