Analysis
-
max time kernel
59s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
20-04-2024 08:09
General
-
Target
fc4f4dfb9f312af032672ae77bc769cb_JaffaCakes118.apk
-
Size
3.2MB
-
MD5
fc4f4dfb9f312af032672ae77bc769cb
-
SHA1
5bd3060d874aef477e63e898285c32bd4a29b0e4
-
SHA256
8045102c0180c6f41b28893a69939004924d8dd9fa4d54a804c69fc5788b3d9f
-
SHA512
cd4e0ecffe434f1ce3e9316b3e093a6d830dbc5d0db2e445759d935714d6e25d3ac66e8c33ffec318202d4250b0e7c8ed69387ba0e31d221000111c64b24d918
-
SSDEEP
49152:PiZZX+J5IR13eGL93TFr4cMXeOpPfr649MYHbbz5C7pcUO58QJ9v9qQtMOPN7+2j:TInPL9jFr4cwhT6gMyo7Q5TTMUNCPLpE
Malware Config
Extracted
cerberus
http://45.146.254.91
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
safe.essence.immune1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
739KB
MD5b48285adabc9a209e4cc9c988736bf78
SHA12b9d0db65e05a1b3feb6ae6ab2a5d740e693d17d
SHA256316bb65dd2bc9153e5448b56de1f06fb71c99cd78333da1bc1af511ae4371c1f
SHA5129e53bceed07e23c0429d34a8b25f5019d6af2be6e10f82c661c835a98b0b45d6c2d057d3ab7a562b772bb4626cac3516d5892946388297cf676b17c5eacfbd67
-
Filesize
739KB
MD59fd8960f9b978b1ecbceeb909939a2f4
SHA178a0e1d8353e8742fa770bfade613f3adf6e1b5f
SHA25659447df621a0dda8d0166d832dea73e1eeb28287f45bd507693b7268d1003ffc
SHA5123b7cb27da5436f957627bd05e1afdbff70cca55da12384c90ad1d3cbc76c1293a2ef181eeee35120281d90ec12d47c94586696c556d5cb832057159087c71f7a
-
Filesize
285B
MD5c816a4ff48d9e3bdb2a8a0fd73d7f3a7
SHA10ac703703f8c880ed71d22015eaef2c95d8d4c9f
SHA256a59edb7453add966a77b5a33fbd4b3b98c2edf1bbfd0f16756db58b3ff9a9c68
SHA51294daad48b5a817e4dc22fcf5ca23bc2ace08dda21b8b93fa4932de796985cf3dfc9581a18fcba832a9b513baf0f3251fd073d52f545fa180bb173965ec142430