Overview

overview

10

Static

static

6

e62736efcf...18.apk

android-9-x86

10

e62736efcf...18.apk

android-10-x64

10

e62736efcf...18.apk

android-11-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    135s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    07-04-2024 23:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e62736efcf51548162c75b2afb915345_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    e62736efcf51548162c75b2afb915345

  • SHA1

    323ba25956e9cf83e790024c2cc60ff5a39a6b46

  • SHA256

    418b67fe185da6593d47174dd5b9e02eef840cbcff2696800b6c5bd7d3474bc0

  • SHA512

    d97948aee3a6ed967e140d997959436e0944edb77ed598d1887cc2e6da1c0a563be57b671084f340e3ee79c839579ebd2d979b009242a4b2723880e3ae2e7ca5

  • SSDEEP

    49152:NZd2k5/fL7KkU06gKMjEjLBFIr5VvGVqePnUYzvOoEj3h1Sxcj:NZMqT79U0RK6EjXWLuFUYbOo01SxU

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://20.90.106.208/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.turn.shoot
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4276
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.turn.shoot/app_DynamicOptDex/AnEe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.turn.shoot/app_DynamicOptDex/oat/x86/AnEe.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4301

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.turn.shoot/app_DynamicOptDex/AnEe.json
    Filesize

    122KB

    MD5

    e75220a5c54a3f3eebf8a0936fa53d2e

    SHA1

    4fa3e55c6c8f2c1325275eccbbb6411f42c8404e

    SHA256

    f108e48780df98c75c3236dfcc3baa2250e58a6be73a0a5e2ff30a62676387af

    SHA512

    2705c52a0ce085f921238c079e7fec9183f0805d4a4507cc8b2864bf3b53e51dc05f571071eebc8489aaaff69e494f7c72120ae674d915aa7d07f86b48a1f5c7

    Download Submit

  • /data/data/com.turn.shoot/app_DynamicOptDex/AnEe.json
    Filesize

    122KB

    MD5

    310f9f9bce2a8ade086c7eb5546ff855

    SHA1

    c5ad5b83114b20d85cb2df09a7fe5bdaaf9c7ff1

    SHA256

    06882e4fbb3fe42ab2d9e6b7676d77fd2d6d23d727def9cd68844420f1ae1bf3

    SHA512

    6711be20b7b7dfec9632a54ec3d036afaa77be76429c0c75fd8505e1c5e492dbde56804ed803ec2fe84a2bac7b85f1627e7cb18f81da6cbbb004370a50891076

    Download Submit

  • /data/data/com.turn.shoot/app_DynamicOptDex/oat/AnEe.json.cur.prof
    Filesize

    846B

    MD5

    cd5aaa83d35b44b5d30f3f7cb3e772ae

    SHA1

    72fdf5e50b465a687b11218255b59da40cc8f9b6

    SHA256

    fcdbec9d5a1afbe29605bb25daa522139bd44a7bf86892413cc8346f469a57e7

    SHA512

    34a6ef9101df0fa38019a3211baa9b491dbf19f6c2b97b63394b435b137df98841891b61b045b5baa1d0ca35a2e73fe662a5a03a5d9dfb5604e801a01a600967

    Download Submit

  • /data/user/0/com.turn.shoot/app_DynamicOptDex/AnEe.json
    Filesize

    122KB

    MD5

    e5e2eef1103c6d66c6c2cb287d7cde58

    SHA1

    4c074b52fb963b3622a3648423557c8f45f74f10

    SHA256

    9f7e3604a157b4da1498110a5a7c8f043d57e53265e1176b51d844625669a944

    SHA512

    dd8d14b44088fe94e785801df4bf2d0af902d162774724f246389ce4b8fcb59beafc9a95361030924671346a951b78928808950ffc56fb69eaa09bece59f1a0a

    Download Submit