Analysis
-
max time kernel
61s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
19-04-2024 13:32
General
-
Target
fa67c0a6efdbbea22f1d48864ca31377_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
fa67c0a6efdbbea22f1d48864ca31377
-
SHA1
bb933c5a089ab1a99c158eb9f6ba0619235094fe
-
SHA256
2ec6a138a4a81be80cd65d15cb05f0b86c57aa1521fc02c8d34ba7ac16e131f1
-
SHA512
6a0469d01f2904849b8a326441587ec94b7cb6a6f90b3c6731ba372d9dace8876f3836a752a0a08390e5835f5290633568d227ab81c813230585856e687f2468
-
SSDEEP
49152:iNgKI7ZL11jzq+frOSaVrCsDfyV2zzo04/ef+QtLMfOsWM5kVz6cH:iNgzdXqAa5ZzyV2zb8eflOfUM5g60
Malware Config
Extracted
cerberus
http://161.97.68.93
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
com.urban.relief1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD580bee2149ae5c480595f2482688abac6
SHA1efa4a07e93bffbe3e0a8de75858adbf286465b80
SHA256e1715399bdb656d494bb59270f7aa3b5e8f0b90c21f3327cb3f4d88c166b8bf9
SHA512de8474b54cb6677d2e3607c26abba639e81432aadf00170223eb273bb235cb9fd1cc9841659d1453a722ce59557ccca89d13ef64b9e0b65ee90fc156089ea55a
-
Filesize
124KB
MD51e49749a348c08ca2b1b9cf6e8daec91
SHA10a4994c318c22bebc844d307e566d39ae3efca03
SHA2563d448e30e56e2e5c422b2d967b097c8372ac3b5514bbc2d50f1f409761605a4c
SHA512131336463b196339e974d36de9c882400c05940d57d6816c9784fe3aa83f478ace0b051f9ad78ae28b466506b8de1131313c02a66a4af76797976ad8d7d27fad
-
Filesize
193B
MD5cf36ac0a07e94ab5803fbd8474fd2937
SHA1e95d9d5c011d0c1b7806fdcc6a5ecde89ddc0afa
SHA2560f1846d4e1917925a645da66bbae422060a78328b42646942984ad546ce9fad7
SHA512efa48ef035003303478aa51c92e5417a63af96897bb5d6f46960d888ce31d5dcb5e380c87cc83106d66c82ec32e477601a2660d115a8f0a611dfaf4f42bbc1a7