Analysis
-
max time kernel
155s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
10-04-2024 19:16
General
-
Target
ebcc01dc4c4f5b5a1d691c5684b4b197_JaffaCakes118.apk
-
Size
3.6MB
-
MD5
ebcc01dc4c4f5b5a1d691c5684b4b197
-
SHA1
81b0a11fa3344e57d37fc97f268532d8339fbbe3
-
SHA256
38e59c9876d09730d7e5d03204ebff9d9b6072108838354e62ab4b62e28bb839
-
SHA512
ec7de69877ee767062fdf4ad375324f22c00b44675c9e037ad07e01a72441f3ef7f4b52048d8c4e62bb8c331ccd52cd85ec0482b6def34944b08d61225bf93e6
-
SSDEEP
98304:5oC2wEsPVsbtNw5KbRQx8/msu+t+v5g6NQjaTZtC:5oC2TsP6bbbRQdsuRv5g6NQj2XC
Malware Config
Extracted
alienbot
http://salakodenekoz.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries account information for other applications stored on the device. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
Processes
-
custom.best.orchard1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device.
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
724KB
MD5466a33fd77d47abeeddde084b0210e30
SHA1ed0fc88b4799f9c9b28e1581757dbbdbb22b7c69
SHA25604fee12db243334767cf584607a509077a10a55f999a26b35137920abd1a738c
SHA512b5b0cc3610caaa7e89fcb0548ac01d175f734f0c8ba90465261ab492f359fba9294c70cae5bf155f8f084aaa9a11c7e94a9e29102de7c752503d4b2b7b70906b
-
Filesize
724KB
MD5cf36de8993386b6609c965319ccaea1e
SHA16aeabcdb1a782831a45c5bbed3f6bf3df8d95b8f
SHA256b8bee9641b7b59e2b2649c46e43cf3f0bb489ef57bbfe08061974f7804aa9328
SHA512039ac96b5d02bef8d8cbaf0b79d31a4b9ff4251f659635f015e00d73e459d70736d4bde227af78eb86597eb9aca78bfa6cbce6af9d78a90b1b260b1b361615de
-
Filesize
380B
MD59ea6174457850fe93bd9e9d5f64370cc
SHA115755960b6d61a54bf85e5d0216c1f7e1fcd9d58
SHA2563617e2bb49812fce1a0e6d8b915154fe04b53482aa19c7a219db11890399ddbb
SHA51286c7d3e40f104f3aa70093f2cda353709b43a02b7dc94a31b340cee4b82878866d4f6f855c09a25d4376a5265137e95c6cc3a9b8c580a9415aeb3a486f1c6311