Analysis
-
max time kernel
62s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
07-04-2024 23:52
General
-
Target
e62736efcf51548162c75b2afb915345_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
e62736efcf51548162c75b2afb915345
-
SHA1
323ba25956e9cf83e790024c2cc60ff5a39a6b46
-
SHA256
418b67fe185da6593d47174dd5b9e02eef840cbcff2696800b6c5bd7d3474bc0
-
SHA512
d97948aee3a6ed967e140d997959436e0944edb77ed598d1887cc2e6da1c0a563be57b671084f340e3ee79c839579ebd2d979b009242a4b2723880e3ae2e7ca5
-
SSDEEP
49152:NZd2k5/fL7KkU06gKMjEjLBFIr5VvGVqePnUYzvOoEj3h1Sxcj:NZMqT79U0RK6EjXWLuFUYbOo01SxU
Malware Config
Extracted
cerberus
http://20.90.106.208/
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.turn.shoot1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5e75220a5c54a3f3eebf8a0936fa53d2e
SHA14fa3e55c6c8f2c1325275eccbbb6411f42c8404e
SHA256f108e48780df98c75c3236dfcc3baa2250e58a6be73a0a5e2ff30a62676387af
SHA5122705c52a0ce085f921238c079e7fec9183f0805d4a4507cc8b2864bf3b53e51dc05f571071eebc8489aaaff69e494f7c72120ae674d915aa7d07f86b48a1f5c7
-
Filesize
122KB
MD5310f9f9bce2a8ade086c7eb5546ff855
SHA1c5ad5b83114b20d85cb2df09a7fe5bdaaf9c7ff1
SHA25606882e4fbb3fe42ab2d9e6b7676d77fd2d6d23d727def9cd68844420f1ae1bf3
SHA5126711be20b7b7dfec9632a54ec3d036afaa77be76429c0c75fd8505e1c5e492dbde56804ed803ec2fe84a2bac7b85f1627e7cb18f81da6cbbb004370a50891076
-
Filesize
272B
MD5cc5084a2ef972ef8aa30f5168ddf7930
SHA1ab1627e0b21845d61a0ac767e11e46bfbdbc3c11
SHA256e5bcd58c871762af4add310513f011aef845145762b54ca7d6b859362065ac09
SHA512d7a6fee1023a963a51c5419aede6769c665448d4049769c9fc3870d33389cb741f405cb7b54d4c76acd2d21234c66eee7dd57041f9bfc511eb47e05ef384c996