Overview

overview

10

Static

static

6

f50a8b6f41...18.apk

android-9-x86

10

f50a8b6f41...18.apk

android-10-x64

10

f50a8b6f41...18.apk

android-11-x64

Analysis

  • max time kernel
    52s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    17-04-2024 04:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f50a8b6f416d2efb30fe6b2b5f83b9da_JaffaCakes118.apk

  • Size

    2.7MB

  • MD5

    f50a8b6f416d2efb30fe6b2b5f83b9da

  • SHA1

    da162c0a3ae612ee779ff781e60b4362880fc7a8

  • SHA256

    cf3bd3c242555867a1e6bdd07e7c9dcc5df5ba5cf15e24ed12ac7e1bc533f829

  • SHA512

    ed3663d0a26262080617d1d7d4e665b772468bfb0f4f9e65fac79649a4db9ee5eeb624e79372a3c50abc4537380e4512484397ae3d6c8cb72a882647598669f7

  • SSDEEP

    49152:s61N+7Je9Q2uXqn3xz0ujzfowyw5ueQ4HM+8GyOUIXCbic3xN1i937reqK:B1Mk9QzXqn3tjzwwyw5hQ4H2GyOUIybv

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://161.97.68.93

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.denial.mirror
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4181

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.denial.mirror/app_DynamicOptDex/FwXIUUa.json
    Filesize

    124KB

    MD5

    db62460afea660a25301d8936e247500

    SHA1

    060f5d20ba6c2d516300eac01c737341d242897b

    SHA256

    e9b43feb4e5d0d7c8f9c709c866f279126777418717c81af5012adc851c21057

    SHA512

    59a0070b7ecda2eccedab7be2312ee40e4e16adf76be67e4baa682e589ca273531c8a2d50e3653571de9cd9431a2d0434c4cec8e3c6d87d67446cf97ae6d8999

    Download Submit
  • /data/data/com.denial.mirror/app_DynamicOptDex/FwXIUUa.json
    Filesize

    124KB

    MD5

    c8de4d9fa770bce2b45bc08b86bec66f

    SHA1

    fc348bed28d5f03145e005fd1c6973adc92daa10

    SHA256

    7648944d6fef1a3f13ced9164006de5ad9e09892aa5f63f659163585c87f3a84

    SHA512

    c1772e449b329bca79ee932532d6878e546cb7a966fbef85515a6a995df18d51094f0566dcd659bd0fa34eb2433e147482f5deaefaecfee984601ffc6643065b

    Download Submit
  • /data/data/com.denial.mirror/app_DynamicOptDex/oat/FwXIUUa.json.cur.prof
    Filesize

    206B

    MD5

    2fcef27ec0a64a0a9f3402a1f500eab5

    SHA1

    ef3613b9e31ef97d2f2cbf83f65ce426003d6b39

    SHA256

    a9247625ab656011c714ef2e7b0875ff93daa8319f9fb4d219913f9e11c13802

    SHA512

    ecac2368cc9dfb8872ac1b44ded828ea10b14e6cfadbb0d8f6a14ba72ab5b3721453aee754480fa79d34a49e20dbb1f254c6556da0cf9f93e52f0931cea4e26e

    Download Submit