Analysis
-
max time kernel
48s -
max time network
152s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
17-04-2024 04:32
General
-
Target
f50a8b6f416d2efb30fe6b2b5f83b9da_JaffaCakes118.apk
-
Size
2.7MB
-
MD5
f50a8b6f416d2efb30fe6b2b5f83b9da
-
SHA1
da162c0a3ae612ee779ff781e60b4362880fc7a8
-
SHA256
cf3bd3c242555867a1e6bdd07e7c9dcc5df5ba5cf15e24ed12ac7e1bc533f829
-
SHA512
ed3663d0a26262080617d1d7d4e665b772468bfb0f4f9e65fac79649a4db9ee5eeb624e79372a3c50abc4537380e4512484397ae3d6c8cb72a882647598669f7
-
SSDEEP
49152:s61N+7Je9Q2uXqn3xz0ujzfowyw5ueQ4HM+8GyOUIXCbic3xN1i937reqK:B1Mk9QzXqn3tjzwwyw5hQ4H2GyOUIybv
Malware Config
Extracted
cerberus
http://161.97.68.93
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.denial.mirror1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5db62460afea660a25301d8936e247500
SHA1060f5d20ba6c2d516300eac01c737341d242897b
SHA256e9b43feb4e5d0d7c8f9c709c866f279126777418717c81af5012adc851c21057
SHA51259a0070b7ecda2eccedab7be2312ee40e4e16adf76be67e4baa682e589ca273531c8a2d50e3653571de9cd9431a2d0434c4cec8e3c6d87d67446cf97ae6d8999
-
Filesize
124KB
MD5c8de4d9fa770bce2b45bc08b86bec66f
SHA1fc348bed28d5f03145e005fd1c6973adc92daa10
SHA2567648944d6fef1a3f13ced9164006de5ad9e09892aa5f63f659163585c87f3a84
SHA512c1772e449b329bca79ee932532d6878e546cb7a966fbef85515a6a995df18d51094f0566dcd659bd0fa34eb2433e147482f5deaefaecfee984601ffc6643065b
-
Filesize
200B
MD579ac27d71f1a5e79dc7378419662a606
SHA1570f0c8c581bf26ff7dc592bf53a10b90fbd6b24
SHA256bfaf660e994654fccc45b03d7266eae7b865bd6da536c593b7379b3c8c63d1da
SHA5126cf08abca063ada416aac7c555665fcaa6491fe938e44c89a1d252be827e260df1f3530c6058a79fe432af5363adeb666324da3bd82e18f9e333888f11e9f5b5