Overview

overview

10

Static

static

6

f8106603bf...18.apk

android-9-x86

10

f8106603bf...18.apk

android-10-x64

10

f8106603bf...18.apk

android-11-x64

Analysis

  • max time kernel
    65s
  • max time network
    128s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    18-04-2024 13:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f8106603bfede22394a73d2fb0a082f0_JaffaCakes118.apk

  • Size

    2.8MB

  • MD5

    f8106603bfede22394a73d2fb0a082f0

  • SHA1

    628f5fc3a684aeffb6eef6b8e7cd83c916776ca7

  • SHA256

    c5888a824cba71e4c6ebca35aad174120f8b681e48af867dfa95ef6a4ba0dc25

  • SHA512

    52d77a5f9f5d8099d7c2129e5de00073b49d5e8a4fd62dbc7a39a91ab92ae59c2f0e139b4e966cbd38f5d883534a15a6091735b0aaf8b4b359e40c5235b18021

  • SSDEEP

    49152:0fyjHfCqZ0lylqy45KqoTF4qd8IGq3gSCItxJGzFauRg46JZHRT6X7scm89pW:jTDZjqNvoJTd4orCIF9zZx6ud

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://144.91.116.117

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.run.dance
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4239
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.run.dance/app_DynamicOptDex/Nd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.run.dance/app_DynamicOptDex/oat/x86/Nd.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4266

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.run.dance/app_DynamicOptDex/Nd.json
    Filesize

    124KB

    MD5

    776552aa66697cf2290a0ddcb1f03339

    SHA1

    d9a949e004fbe1aef96127fa5141eb2b994ff623

    SHA256

    92f201f95c80b71c68624bec7259cd0decb1e4d3e7e13daa83102d501a3453cf

    SHA512

    44c62cbfab94255597564086a63ea7374a955a11e6a265fb7c05a3b57632d547d737837cd8bc88bb75b6283aa47251da0ad9aaf2bd0253672281bb744b38a92a

    Download Submit
  • /data/data/com.run.dance/app_DynamicOptDex/Nd.json
    Filesize

    124KB

    MD5

    4f089f6a131f4c0a8312a98a4bff35b4

    SHA1

    403a0fe503676987b50f30dd956de55a40a37320

    SHA256

    684bd7d31aac838262660b0ed84c32a3dfe2e55ca75ddaae36372df115b500f9

    SHA512

    a59cb35e3a4ae249e7466793e8009fbe365f7cf5d65c5278445bf997ec4263374f4984ff000fa408abbbe8770b39f44f2ab063227ebc7375935323d9363fc0ca

    Download Submit
  • /data/data/com.run.dance/app_DynamicOptDex/oat/Nd.json.cur.prof
    Filesize

    818B

    MD5

    a21485eefe6b00d47b9eaf094c657c75

    SHA1

    3731730a15f046825b678bb0bae0c8bebc1dc830

    SHA256

    884af5d394d73155ff861fcf96679b78351d772a4aa0a857231fe85379640d46

    SHA512

    73ea0cc7e01450c81ce3169565573d3575b42d73f965e6a3ed7a8af1961d150152692d5a0c4a45a964463b0d271327afc163d781164fb3953c2f7506bde997ac

    Download Submit
  • /data/user/0/com.run.dance/app_DynamicOptDex/Nd.json
    Filesize

    124KB

    MD5

    a61dc1fe65eea24932c4102da4e36ce2

    SHA1

    9161d7b8d1c58bd15f00be32d6c62bbe1bdaf9fe

    SHA256

    482decd60209129b941e36357639ab20e9bcdabe30c2a4ffa4f51bcfbbfd8fe5

    SHA512

    1426a980b885661ecb8d403b4d63b6a322d5213f9ebac98daffe406e3ba49d0df76c0f1705a2766c529200df7c03d98e7b716ec750315ffcd15a2810a268fd69

    Download Submit