Overview

overview

10

Static

static

6

fa67c0a6ef...18.apk

android-9-x86

10

fa67c0a6ef...18.apk

android-10-x64

10

fa67c0a6ef...18.apk

android-11-x64

Analysis

  • max time kernel
    61s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    19-04-2024 13:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa67c0a6efdbbea22f1d48864ca31377_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    fa67c0a6efdbbea22f1d48864ca31377

  • SHA1

    bb933c5a089ab1a99c158eb9f6ba0619235094fe

  • SHA256

    2ec6a138a4a81be80cd65d15cb05f0b86c57aa1521fc02c8d34ba7ac16e131f1

  • SHA512

    6a0469d01f2904849b8a326441587ec94b7cb6a6f90b3c6731ba372d9dace8876f3836a752a0a08390e5835f5290633568d227ab81c813230585856e687f2468

  • SSDEEP

    49152:iNgKI7ZL11jzq+frOSaVrCsDfyV2zzo04/ef+QtLMfOsWM5kVz6cH:iNgzdXqAa5ZzyV2zb8eflOfUM5g60

Score
10/10
cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://161.97.68.93

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.urban.relief
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5041

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.urban.relief/app_DynamicOptDex/bLOM.json
    Filesize

    124KB

    MD5

    80bee2149ae5c480595f2482688abac6

    SHA1

    efa4a07e93bffbe3e0a8de75858adbf286465b80

    SHA256

    e1715399bdb656d494bb59270f7aa3b5e8f0b90c21f3327cb3f4d88c166b8bf9

    SHA512

    de8474b54cb6677d2e3607c26abba639e81432aadf00170223eb273bb235cb9fd1cc9841659d1453a722ce59557ccca89d13ef64b9e0b65ee90fc156089ea55a

    Download Submit
  • /data/data/com.urban.relief/app_DynamicOptDex/bLOM.json
    Filesize

    124KB

    MD5

    1e49749a348c08ca2b1b9cf6e8daec91

    SHA1

    0a4994c318c22bebc844d307e566d39ae3efca03

    SHA256

    3d448e30e56e2e5c422b2d967b097c8372ac3b5514bbc2d50f1f409761605a4c

    SHA512

    131336463b196339e974d36de9c882400c05940d57d6816c9784fe3aa83f478ace0b051f9ad78ae28b466506b8de1131313c02a66a4af76797976ad8d7d27fad

    Download Submit
  • /data/data/com.urban.relief/app_DynamicOptDex/oat/bLOM.json.cur.prof
    Filesize

    193B

    MD5

    cf36ac0a07e94ab5803fbd8474fd2937

    SHA1

    e95d9d5c011d0c1b7806fdcc6a5ecde89ddc0afa

    SHA256

    0f1846d4e1917925a645da66bbae422060a78328b42646942984ad546ce9fad7

    SHA512

    efa48ef035003303478aa51c92e5417a63af96897bb5d6f46960d888ce31d5dcb5e380c87cc83106d66c82ec32e477601a2660d115a8f0a611dfaf4f42bbc1a7

    Download Submit