Overview

overview

10

Static

static

10

fd4fa33f9f...18.apk

android-9-x86

10

fd4fa33f9f...18.apk

android-10-x64

1

fd4fa33f9f...18.apk

android-11-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd4fa33f9fb8f0fbc62d60f83a0ee287_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240420-wk3v8seb57

  • MD5

    fd4fa33f9fb8f0fbc62d60f83a0ee287

  • SHA1

    f1e6da0a218dc77c60c441e882923841af8435d4

  • SHA256

    1811bd1c7300746f8eb515ce096834ac4524a80c2fc990b7f4874e070501ddf7

  • SHA512

    60a729a0b2445322f9641e4eb8f964b064b0b77b3ccec61f06e53ef877cc6cd1ef89b00c41c47722f5e4e9a1804f1784afad346764e0e1f529f532c0ba549e1f

  • SSDEEP

    49152:sEBaYhGdUKqRQ9wnHIdKVDoSYqixkJGlHlODoqwjg5V0J6X:BYqG7qBHImDUDkJgH8Ufk7CC

Score
10/10
cerberusjokerandroidbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://109.205.182.228

Targets

    • Target

      fd4fa33f9fb8f0fbc62d60f83a0ee287_JaffaCakes118

    • Size

      2.9MB

    • MD5

      fd4fa33f9fb8f0fbc62d60f83a0ee287

    • SHA1

      f1e6da0a218dc77c60c441e882923841af8435d4

    • SHA256

      1811bd1c7300746f8eb515ce096834ac4524a80c2fc990b7f4874e070501ddf7

    • SHA512

      60a729a0b2445322f9641e4eb8f964b064b0b77b3ccec61f06e53ef877cc6cd1ef89b00c41c47722f5e4e9a1804f1784afad346764e0e1f529f532c0ba549e1f

    • SSDEEP

      49152:sEBaYhGdUKqRQ9wnHIdKVDoSYqixkJGlHlODoqwjg5V0J6X:BYqG7qBHImDUDkJgH8Ufk7CC

    Score
    10/10
    cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

      bankertrojaninfostealerevasionratcerberus

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

      evasiondiscovery

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

      evasiondiscovery

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Queries the mobile country code (MCC)

      discovery

    • Registers a broadcast receiver at runtime (usually for listening for system events)

      persistence

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Listens for changes in the sensor environment (might be used to detect emulation)

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks