Analysis
-
max time kernel
52s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
17-04-2024 04:32
General
-
Target
f50a8b6f416d2efb30fe6b2b5f83b9da_JaffaCakes118.apk
-
Size
2.7MB
-
MD5
f50a8b6f416d2efb30fe6b2b5f83b9da
-
SHA1
da162c0a3ae612ee779ff781e60b4362880fc7a8
-
SHA256
cf3bd3c242555867a1e6bdd07e7c9dcc5df5ba5cf15e24ed12ac7e1bc533f829
-
SHA512
ed3663d0a26262080617d1d7d4e665b772468bfb0f4f9e65fac79649a4db9ee5eeb624e79372a3c50abc4537380e4512484397ae3d6c8cb72a882647598669f7
-
SSDEEP
49152:s61N+7Je9Q2uXqn3xz0ujzfowyw5ueQ4HM+8GyOUIXCbic3xN1i937reqK:B1Mk9QzXqn3tjzwwyw5hQ4H2GyOUIybv
Malware Config
Extracted
cerberus
http://161.97.68.93
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.denial.mirror1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5db62460afea660a25301d8936e247500
SHA1060f5d20ba6c2d516300eac01c737341d242897b
SHA256e9b43feb4e5d0d7c8f9c709c866f279126777418717c81af5012adc851c21057
SHA51259a0070b7ecda2eccedab7be2312ee40e4e16adf76be67e4baa682e589ca273531c8a2d50e3653571de9cd9431a2d0434c4cec8e3c6d87d67446cf97ae6d8999
-
Filesize
124KB
MD5c8de4d9fa770bce2b45bc08b86bec66f
SHA1fc348bed28d5f03145e005fd1c6973adc92daa10
SHA2567648944d6fef1a3f13ced9164006de5ad9e09892aa5f63f659163585c87f3a84
SHA512c1772e449b329bca79ee932532d6878e546cb7a966fbef85515a6a995df18d51094f0566dcd659bd0fa34eb2433e147482f5deaefaecfee984601ffc6643065b
-
Filesize
206B
MD52fcef27ec0a64a0a9f3402a1f500eab5
SHA1ef3613b9e31ef97d2f2cbf83f65ce426003d6b39
SHA256a9247625ab656011c714ef2e7b0875ff93daa8319f9fb4d219913f9e11c13802
SHA512ecac2368cc9dfb8872ac1b44ded828ea10b14e6cfadbb0d8f6a14ba72ab5b3721453aee754480fa79d34a49e20dbb1f254c6556da0cf9f93e52f0931cea4e26e