Overview

overview

10

Static

static

6

faecf55db4...18.apk

android-9-x86

10

faecf55db4...18.apk

android-10-x64

10

faecf55db4...18.apk

android-11-x64

10

Analysis

  • max time kernel
    85s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    19-04-2024 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    faecf55db465a39442e679e6fe47ab9a_JaffaCakes118.apk

  • Size

    3.2MB

  • MD5

    faecf55db465a39442e679e6fe47ab9a

  • SHA1

    caa22afad87d73792e7209224eb7cdaea9b5a416

  • SHA256

    e37660730f3a87fdd9b237847e5d56017e9f344578608c0af44c5c4eacb7ae3b

  • SHA512

    87f1130d1dc377ef1bcb26d1b3a50a6bc3d3daeccd42b540dfc0030964002ca7dfd5534d06d3c6d0622f19f21accafa7b0e034df2a8993d28ff361e1b5e75454

  • SSDEEP

    98304:MacDQCcxnv8BqxVlLX5PlI9bgkaFivU/D4pIrHjo:MacDQCclwqxVbPlI9bPaFiyo

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://tamakontelloycaxyz.site

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • pottery.scan.right
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4248
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pottery.scan.right/app_DynamicOptDex/gGQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/pottery.scan.right/app_DynamicOptDex/oat/x86/gGQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4275

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/pottery.scan.right/app_DynamicOptDex/gGQ.json
    Filesize

    790KB

    MD5

    4aaf3ed3a0a70bb60305b72d8aaeda37

    SHA1

    852ff46e6d4f84b69c7d3d0b1da2b9c4bb59818a

    SHA256

    990c994e83058dadc1fafdca6c11ed7e6253607eac1af5e3712977007833fc7c

    SHA512

    a61661393ecf8fe025e1e75a9676735db5f97245588002e6c94acfb7df6240a3cf39230021df75d12b26e2531be6a35494a617f09ec5de1650ab99738f52f791

    Download Submit

  • /data/data/pottery.scan.right/app_DynamicOptDex/gGQ.json
    Filesize

    790KB

    MD5

    e0dc62d3576e9d3e3234c6e313638a72

    SHA1

    756ec30841c88c70a5af63254140b905da21e1d8

    SHA256

    630bbb93845e3ac4be568ad25fdf68920e42c809eddd0c0f1111b03be1525ab1

    SHA512

    4f553213376827907d98d42ccce8bf9a0e9e0fdbecf0b21d8df5992df28769f9eb285e97d9ea9b4b6dffba8361cc1b7cd69aaac9232ff7586e54182e800e5c11

    Download Submit

  • /data/data/pottery.scan.right/app_DynamicOptDex/oat/gGQ.json.cur.prof
    Filesize

    876B

    MD5

    d77a0093ae14ed7333e73e603e962fd6

    SHA1

    193d7b8e4de91dd58a704640a63f54b4ed8d5594

    SHA256

    2ab92bb6cbe7f13d9343eafacf76001b936fbbdc367cdcf1647f21f43bfe2997

    SHA512

    8f1d3e62c310bcaa7da6a9c5ba077304b58fde2ccde4cf18f2d9383742541318f46ab8f3cbe905171b2f143fcc2c4d3925054b99684374e1bde8c7797983936f

    Download Submit

  • /data/user/0/pottery.scan.right/app_DynamicOptDex/gGQ.json
    Filesize

    790KB

    MD5

    a20c8da6b7a3abbb27700aa77e9207ae

    SHA1

    aafc765a4f5e3cded5d2934c277e63d43d530631

    SHA256

    1da7b56f8360da5b4addcfbb9d0612ac0c4136b53007abdffb53c94d99c5cdce

    SHA512

    4e7cf33c04e848e1975c03962ed2aca94dd3d2de57c1f52bb6e635f3a62daa86076495800fdaf020ee44997fd4c288b1c0d6bb3ff01cd31b158afd2eac5aa7e2

    Download Submit