Analysis
-
max time kernel
57s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
08-04-2024 20:34
General
-
Target
e85acf42bb804f201e94105d1ec688e4_JaffaCakes118.apk
-
Size
183KB
-
MD5
e85acf42bb804f201e94105d1ec688e4
-
SHA1
49974af557037cd5fe7aeacff31334598a396454
-
SHA256
13071a5132728047f11cfc63fc7576ce506981ecf4794e58cfaf17d4d9349cdb
-
SHA512
c815e638002a44c8ff285d9dd0dd8564a6c78008e28c4984b8b687d1a36cd13715ce8676b5b5d5997752ee033832e0dcba6f93b9726d7c707c9495b201cd9ce7
-
SSDEEP
3072:DcLcelldC3cY4RB6klmflCpkFE6bBa15gFYIWe+XHK+FMn9LKAl+Az0DLK7t++wD:ocexO4RB6TlQkF3bBa15Ip0rW9+Al+Aq
Malware Config
Extracted
cerberus
https://yurdadonusvakfi.xyz
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.dbbmbpeslwdh.wvibsjl1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)