Overview

overview

10

Static

static

6

f8106603bf...18.apk

android-9-x86

10

f8106603bf...18.apk

android-10-x64

10

f8106603bf...18.apk

android-11-x64

Analysis

  • max time kernel
    45s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    18-04-2024 13:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f8106603bfede22394a73d2fb0a082f0_JaffaCakes118.apk

  • Size

    2.8MB

  • MD5

    f8106603bfede22394a73d2fb0a082f0

  • SHA1

    628f5fc3a684aeffb6eef6b8e7cd83c916776ca7

  • SHA256

    c5888a824cba71e4c6ebca35aad174120f8b681e48af867dfa95ef6a4ba0dc25

  • SHA512

    52d77a5f9f5d8099d7c2129e5de00073b49d5e8a4fd62dbc7a39a91ab92ae59c2f0e139b4e966cbd38f5d883534a15a6091735b0aaf8b4b359e40c5235b18021

  • SSDEEP

    49152:0fyjHfCqZ0lylqy45KqoTF4qd8IGq3gSCItxJGzFauRg46JZHRT6X7scm89pW:jTDZjqNvoJTd4orCIF9zZx6ud

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://144.91.116.117

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.run.dance
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.run.dance/app_DynamicOptDex/Nd.json
    Filesize

    124KB

    MD5

    776552aa66697cf2290a0ddcb1f03339

    SHA1

    d9a949e004fbe1aef96127fa5141eb2b994ff623

    SHA256

    92f201f95c80b71c68624bec7259cd0decb1e4d3e7e13daa83102d501a3453cf

    SHA512

    44c62cbfab94255597564086a63ea7374a955a11e6a265fb7c05a3b57632d547d737837cd8bc88bb75b6283aa47251da0ad9aaf2bd0253672281bb744b38a92a

    Download Submit
  • /data/data/com.run.dance/app_DynamicOptDex/Nd.json
    Filesize

    124KB

    MD5

    4f089f6a131f4c0a8312a98a4bff35b4

    SHA1

    403a0fe503676987b50f30dd956de55a40a37320

    SHA256

    684bd7d31aac838262660b0ed84c32a3dfe2e55ca75ddaae36372df115b500f9

    SHA512

    a59cb35e3a4ae249e7466793e8009fbe365f7cf5d65c5278445bf997ec4263374f4984ff000fa408abbbe8770b39f44f2ab063227ebc7375935323d9363fc0ca

    Download Submit
  • /data/data/com.run.dance/app_DynamicOptDex/oat/Nd.json.cur.prof
    Filesize

    214B

    MD5

    42efe6715c8b2491b010df3bec9490e5

    SHA1

    773bc851a7296fadcc858fbcc607d1c7448754f2

    SHA256

    7e8b396cb487b76f2bcc7abcfab67dc3c4b0b122a4a22692ef827d9e65decf7c

    SHA512

    492aa4a0e69e0f373088308705a7867067505131fd6be473dd6b9dbdcd23783311932c791972856fa1487403d1561fb6f6ed435c8860bb05950c56ff7df64c51

    Download Submit