Analysis
- max time kernel
67s - max time network
151s - platform
android_x64 - resource
android-x64-20240221-en - resource tags
- submitted
11/04/2024, 19:09
General
- Target ee2370e2a1a7f85a99ece79d33a51b6b_JaffaCakes118.apk
- Size 133KB
- Sample240411-xtx7saad23
- SHA256 075352f0f8ac06163f06380fba36d778046e5c9ce3ffa15ef082f2ea1fec09eb
Score
10/10
Malware Config
Extracted
Family
-
cerberus
C2
-
https://bensiznekadarmutluolabilirsinki.club
Signatures
- Cerberus
An Android banker that is being rented to actors beginning in 2019.
- Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.swivvtvzoky.ktmuzxo1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Listens for changes in the sensor environment (might be used to detect emulation)