Analysis
-
max time kernel
73s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
07-04-2024 17:18
General
-
Target
e573a2a027ac3b2a38dcc393c225bc82_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
e573a2a027ac3b2a38dcc393c225bc82
-
SHA1
03f7e2b5dbf775310ad00c24e9ce61643c111cc1
-
SHA256
56ff51106087a26828bc7903a03ee01799eb7916311db6e87f650a9580ddafc0
-
SHA512
3463b6d4ad404d7da924d05ec5b00fb8be1d94178a24c4994fc8e18702b3762d18f053bce30dbedcfcbeb0fac3b670e666bd3caca0341a275f27412d2d69e83c
-
SSDEEP
49152:GATX3+yA84mFOsJA/vQQWsoMF6Cbue50K0nNUYqRyP/34X:GmXui4mFRmQLsoMFNKe50K0O5Q/32
Malware Config
Extracted
cerberus
http://161.97.68.93
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.connect.nurse1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD51153d3b84e8e25f9c07b9aeb569af2bd
SHA1ec4d7da526ed44216a6087f28401063326c9da00
SHA2563880ec3802dc673b3ec0dd0dcac0918c4bb496b14827a14328cb69c284e94f8f
SHA5122b4d4ffd7551efe10f589076b1487716573fb63c27de2176715e27785ebc98d05b7d780cd3a97c387f10f59f99728540d002ab58fd5bc08c2bac38000dfbe05a
-
Filesize
124KB
MD5120f25eda4f6c437beb18531cfd9cf4e
SHA12d6f3d3a6dfed7eaf992fdfe7f3da73f076f143b
SHA256a1d70721f81cc14801a8f38d82f1c2df621d11ef622cf45ac142552c36386055
SHA51253dcb2f04306126338e66ec10b79f78724453d3999696fcd405f282f401442966bde63019ba2d2700bf251208701067e39bb212245b8808c4b120e46d60b15c8
-
Filesize
176B
MD5c06c7a984df14ac2fd99a341afd636a9
SHA1b22eca6fa309c3c0806bb03765523d965f318169
SHA256eb3283c8567456ae0d075a45ab5f5a2e1e5cbda2ec0d571cc4c087745a9db085
SHA512a3923f2042a7e374f5fe6797da113a5bb02153ad2d24594a7fe60b68332327f94bf30c528b1863d6ca7086484ed2ac9e0f448235e891dab10476a1e71ef7a7df