Overview

overview

10

Static

static

6

fc4f4dfb9f...18.apk

android-9-x86

10

fc4f4dfb9f...18.apk

android-10-x64

10

fc4f4dfb9f...18.apk

android-11-x64

Analysis

  • max time kernel
    85s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    20-04-2024 08:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc4f4dfb9f312af032672ae77bc769cb_JaffaCakes118.apk

  • Size

    3.2MB

  • MD5

    fc4f4dfb9f312af032672ae77bc769cb

  • SHA1

    5bd3060d874aef477e63e898285c32bd4a29b0e4

  • SHA256

    8045102c0180c6f41b28893a69939004924d8dd9fa4d54a804c69fc5788b3d9f

  • SHA512

    cd4e0ecffe434f1ce3e9316b3e093a6d830dbc5d0db2e445759d935714d6e25d3ac66e8c33ffec318202d4250b0e7c8ed69387ba0e31d221000111c64b24d918

  • SSDEEP

    49152:PiZZX+J5IR13eGL93TFr4cMXeOpPfr649MYHbbz5C7pcUO58QJ9v9qQtMOPN7+2j:TInPL9jFr4cwhT6gMyo7Q5TTMUNCPLpE

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://45.146.254.91

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • safe.essence.immune
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4463
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/safe.essence.immune/app_DynamicOptDex/fP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/safe.essence.immune/app_DynamicOptDex/oat/x86/fP.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4488

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/safe.essence.immune/app_DynamicOptDex/fP.json
    Filesize

    739KB

    MD5

    b48285adabc9a209e4cc9c988736bf78

    SHA1

    2b9d0db65e05a1b3feb6ae6ab2a5d740e693d17d

    SHA256

    316bb65dd2bc9153e5448b56de1f06fb71c99cd78333da1bc1af511ae4371c1f

    SHA512

    9e53bceed07e23c0429d34a8b25f5019d6af2be6e10f82c661c835a98b0b45d6c2d057d3ab7a562b772bb4626cac3516d5892946388297cf676b17c5eacfbd67

    Download Submit

  • /data/data/safe.essence.immune/app_DynamicOptDex/fP.json
    Filesize

    739KB

    MD5

    9fd8960f9b978b1ecbceeb909939a2f4

    SHA1

    78a0e1d8353e8742fa770bfade613f3adf6e1b5f

    SHA256

    59447df621a0dda8d0166d832dea73e1eeb28287f45bd507693b7268d1003ffc

    SHA512

    3b7cb27da5436f957627bd05e1afdbff70cca55da12384c90ad1d3cbc76c1293a2ef181eeee35120281d90ec12d47c94586696c556d5cb832057159087c71f7a

    Download Submit

  • /data/data/safe.essence.immune/app_DynamicOptDex/oat/fP.json.cur.prof
    Filesize

    913B

    MD5

    fdda36e834ea8dbefa5f2a4bc66f1295

    SHA1

    f7ac274213ff24eddfb4e631fd23a245d250326e

    SHA256

    f44869231fd7141473a17cfa4df5d8113b789bc1161eb28ca0a0d3b08232cc8a

    SHA512

    77c7623f6d1177e799adadcda677d5ba91a837c76324bd7ce50f873dc9422b348258475c36f6242901d0ff1543a239c46cf02eadf2c3ef3bec0da5f6e46fc361

    Download Submit

  • /data/user/0/safe.essence.immune/app_DynamicOptDex/fP.json
    Filesize

    739KB

    MD5

    a24ccabb6af3de862219c413e987c7be

    SHA1

    65a7de70e9959176f85f33731665ec7aaf274c24

    SHA256

    f1cfe5a3cf5ccb50cf4663403d76f1bb7a8fcb0eaa1960d0ca7c9d0a58bff135

    SHA512

    275477b064987541fd12fe9bbe04745f5b21c3d0200242483c11f1bdb2dc4173595324075374fbd9083cff08ede673ddf477299502c092336e44b48ba31ee422

    Download Submit