Analysis
-
max time kernel
45s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
18-04-2024 13:10
General
-
Target
f8106603bfede22394a73d2fb0a082f0_JaffaCakes118.apk
-
Size
2.8MB
-
MD5
f8106603bfede22394a73d2fb0a082f0
-
SHA1
628f5fc3a684aeffb6eef6b8e7cd83c916776ca7
-
SHA256
c5888a824cba71e4c6ebca35aad174120f8b681e48af867dfa95ef6a4ba0dc25
-
SHA512
52d77a5f9f5d8099d7c2129e5de00073b49d5e8a4fd62dbc7a39a91ab92ae59c2f0e139b4e966cbd38f5d883534a15a6091735b0aaf8b4b359e40c5235b18021
-
SSDEEP
49152:0fyjHfCqZ0lylqy45KqoTF4qd8IGq3gSCItxJGzFauRg46JZHRT6X7scm89pW:jTDZjqNvoJTd4orCIF9zZx6ud
Malware Config
Extracted
cerberus
http://144.91.116.117
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.run.dance1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5776552aa66697cf2290a0ddcb1f03339
SHA1d9a949e004fbe1aef96127fa5141eb2b994ff623
SHA25692f201f95c80b71c68624bec7259cd0decb1e4d3e7e13daa83102d501a3453cf
SHA51244c62cbfab94255597564086a63ea7374a955a11e6a265fb7c05a3b57632d547d737837cd8bc88bb75b6283aa47251da0ad9aaf2bd0253672281bb744b38a92a
-
Filesize
124KB
MD54f089f6a131f4c0a8312a98a4bff35b4
SHA1403a0fe503676987b50f30dd956de55a40a37320
SHA256684bd7d31aac838262660b0ed84c32a3dfe2e55ca75ddaae36372df115b500f9
SHA512a59cb35e3a4ae249e7466793e8009fbe365f7cf5d65c5278445bf997ec4263374f4984ff000fa408abbbe8770b39f44f2ab063227ebc7375935323d9363fc0ca
-
Filesize
214B
MD542efe6715c8b2491b010df3bec9490e5
SHA1773bc851a7296fadcc858fbcc607d1c7448754f2
SHA2567e8b396cb487b76f2bcc7abcfab67dc3c4b0b122a4a22692ef827d9e65decf7c
SHA512492aa4a0e69e0f373088308705a7867067505131fd6be473dd6b9dbdcd23783311932c791972856fa1487403d1561fb6f6ed435c8860bb05950c56ff7df64c51