Analysis
-
max time kernel
84s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
07-04-2024 17:18
General
-
Target
e573a2a027ac3b2a38dcc393c225bc82_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
e573a2a027ac3b2a38dcc393c225bc82
-
SHA1
03f7e2b5dbf775310ad00c24e9ce61643c111cc1
-
SHA256
56ff51106087a26828bc7903a03ee01799eb7916311db6e87f650a9580ddafc0
-
SHA512
3463b6d4ad404d7da924d05ec5b00fb8be1d94178a24c4994fc8e18702b3762d18f053bce30dbedcfcbeb0fac3b670e666bd3caca0341a275f27412d2d69e83c
-
SSDEEP
49152:GATX3+yA84mFOsJA/vQQWsoMF6Cbue50K0nNUYqRyP/34X:GmXui4mFRmQLsoMFNKe50K0O5Q/32
Malware Config
Extracted
cerberus
http://161.97.68.93
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.connect.nurse1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.connect.nurse/app_DynamicOptDex/lon.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.connect.nurse/app_DynamicOptDex/oat/x86/lon.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD51153d3b84e8e25f9c07b9aeb569af2bd
SHA1ec4d7da526ed44216a6087f28401063326c9da00
SHA2563880ec3802dc673b3ec0dd0dcac0918c4bb496b14827a14328cb69c284e94f8f
SHA5122b4d4ffd7551efe10f589076b1487716573fb63c27de2176715e27785ebc98d05b7d780cd3a97c387f10f59f99728540d002ab58fd5bc08c2bac38000dfbe05a
-
Filesize
124KB
MD5120f25eda4f6c437beb18531cfd9cf4e
SHA12d6f3d3a6dfed7eaf992fdfe7f3da73f076f143b
SHA256a1d70721f81cc14801a8f38d82f1c2df621d11ef622cf45ac142552c36386055
SHA51253dcb2f04306126338e66ec10b79f78724453d3999696fcd405f282f401442966bde63019ba2d2700bf251208701067e39bb212245b8808c4b120e46d60b15c8
-
Filesize
818B
MD59bcc75798e61e34bdadc54653404c397
SHA1c9d16704b14f01c6468f8502184d0a65c4e1f51c
SHA256d4e6d0ba64e3e9af3d7fc0528d7cf01f0fd49ffb7debdf5057653ec3dd8fe231
SHA512334dc9695e7cc2a24548fe13506937e9503fac18aa85b191ad4294bb487566175f85d18919c32df9a10f1c25baba81832cbbfbfe856f3ddefc5a2c2ad1ae21dc
-
Filesize
124KB
MD50ed19e047319064f68227b531b6f3d56
SHA10c5b19aa048424ba9145d49d05f499d655da262b
SHA256cb6bc302ff3f44f4857e1ae87422dc17cc84373cf6e30dee6e411285afa84165
SHA5126c17c9abb9bd229a662a4342d87ff45da6e19ac06b052412b8782fb66e6f7f990bbea6e0d94a39f80b718de02638e0baefb3e6f500daf7372afbadc9a7d1b244