Overview

overview

10

Static

static

10

fd4fa33f9f...18.apk

android-9-x86

10

fd4fa33f9f...18.apk

android-10-x64

1

fd4fa33f9f...18.apk

android-11-x64

Analysis

  • max time kernel
    85s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    20-04-2024 17:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fd4fa33f9fb8f0fbc62d60f83a0ee287_JaffaCakes118.apk

  • Size

    2.9MB

  • MD5

    fd4fa33f9fb8f0fbc62d60f83a0ee287

  • SHA1

    f1e6da0a218dc77c60c441e882923841af8435d4

  • SHA256

    1811bd1c7300746f8eb515ce096834ac4524a80c2fc990b7f4874e070501ddf7

  • SHA512

    60a729a0b2445322f9641e4eb8f964b064b0b77b3ccec61f06e53ef877cc6cd1ef89b00c41c47722f5e4e9a1804f1784afad346764e0e1f529f532c0ba549e1f

  • SSDEEP

    49152:sEBaYhGdUKqRQ9wnHIdKVDoSYqixkJGlHlODoqwjg5V0J6X:BYqG7qBHImDUDkJgH8Ufk7CC

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://109.205.182.228

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion

Processes

  • com.pulp.cereal
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4269
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pulp.cereal/app_DynamicOptDex/Ga.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pulp.cereal/app_DynamicOptDex/oat/x86/Ga.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4295

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.pulp.cereal/app_DynamicOptDex/Ga.json
    Filesize

    124KB

    MD5

    dd46f635411bd46ffcce48e944a1d9d9

    SHA1

    a76557a13ad5acdb7c6b6958eecf71414285a451

    SHA256

    ae4eea8ffb04aea624cb2c985509ea957836a3b2bd8e666554a471b9a4bf1f64

    SHA512

    eb413095802b17df8bcb347cbce3992db9e5f78ec2b0d8ec322d62c7f1de9d535bd0bfb210163efbcf24866e71fe01b2db192a6082cde8ab2518aa311e696abc

    Download Submit

  • /data/data/com.pulp.cereal/app_DynamicOptDex/Ga.json
    Filesize

    124KB

    MD5

    6f47cef5a19bb54876bee82f43a1b24c

    SHA1

    fae6f11da5791cf1eecdac35597974854d2c6114

    SHA256

    b02b861b4e181569e8e6ae8dbfb13709aaa57a4d7e35a25ec488d03c65338ea0

    SHA512

    80a4958963af1f85075ab3d8f89076dfe5787f002b67095ab06ad6eea69bbcaa900a32c50d00720dc99199c4637cc445a3c677b2edf52f2f88c962baf70de39e

    Download Submit

  • /data/data/com.pulp.cereal/app_DynamicOptDex/oat/Ga.json.cur.prof
    Filesize

    814B

    MD5

    38c2803b5d99ebb7ee3a3e69840d6917

    SHA1

    6f7d37a7a4f50cb82b92731d1d39975086ea7a4f

    SHA256

    9c3c26f3fa0fb86bec18c11024575cba274368063e173f47748ef6aa05db5eff

    SHA512

    27810b5dffb6d933bb17177478bf249197451975787a40fc487f5ad7770dd49cd3e7f5cb684e8a5bfcf63b338fa2ff12e2f47d9215d80c3f57f5b640c6fbc8bd

    Download Submit

  • /data/user/0/com.pulp.cereal/app_DynamicOptDex/Ga.json
    Filesize

    124KB

    MD5

    67cdf5bc84b4ff9e48d9e1faaafe7b69

    SHA1

    346420dc9be1c8f98121da52a2cd85a8e1979b40

    SHA256

    73f9e5314c8a809db54bd3a15bee83a7acb8f330a69f3ad3d14be397dca9eec1

    SHA512

    11b6b5a42328f3c20fe6d9c576d009ffdba33d02dd24d9e7e5f9cc500785b21bf5bee4bcd65e6b50cb06c1f3985487a386c30204b4137b21c9c4e08e11455b11

    Download Submit