Analysis
-
max time kernel
150s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
-
submitted
12-05-2024 13:04
General
-
Target
3a41995a56fb1daa066d0c8c6464c861_JaffaCakes118.apk
-
Size
1.5MB
-
MD5
3a41995a56fb1daa066d0c8c6464c861
-
SHA1
4ed5c16e3e7212d18e3804e9f42a7f90e6eef24d
-
SHA256
ca4bf446ab44314ec4aa8d06034af2bd1e40455665ccd9ff48cfef5234bc678c
-
SHA512
be5e017bd5cd1e03c880245fbdb30e99b1e46bcf0f5e7c23c735b05bac07f9cb388fb19c1d3d5b076e52f95bdfc67e31403393afddb8d045bd0bb362159b0c95
-
SSDEEP
49152:9YR2Z1nhGT/BXZn2aQGkPUho0LkBNEsMU:ev/BXZn2aho0gBNEsMU
Malware Config
Extracted
alienbot
http://nesenbenibitirebildin.cyou
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
hhamwcayidnujxczby.pezsfhsnpzpnpfkphodymtcpsp.tntskbjmsd1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
695KB
MD5fbc591cdfc9384907903aabdf3b789d3
SHA1cd323e9e9eee6151692fe3a2281bddbcbc6bdbbb
SHA2565cfeb8bdeebe5e9c7066e2b6ea16adc48331e166ca1ac0831c1253ed87606047
SHA51237369a333aaf05f87042f05e4387f32727b4196296548ef4f71484859e0c551796b342836133b218d4f6c849724f5fb835842fd0618a75ee791a9905e6416c7e
-
Filesize
695KB
MD541c03ceb562697bca859df75b1ca5e3c
SHA1e07c832d29157eec1daff82a399788dfd91038bc
SHA256dc749d6e0197a2bc3059c3e1b134b3654c3873aeca05acf3d23c62a2f8946a7e
SHA51276cb36ae825b3fd8a0f310cca4529f23c4c345c14e4b8cd39feafb45e42499190f20651b0c40eae98461d1232bed64e0d1927765af2ae85bbbab2b2556891eb2
-
Filesize
447B
MD544ca37f1ba8331e8c5f7453e1a8ffcc8
SHA1a8b5f5fe5734c286e20e525d4ef9c79a2021298a
SHA25668c89ddf6735f30b562155c8fab392044d969a70d32fb1dfe10de7439c4231a3
SHA512e290dee35344da9f1fe14c828e3a281c16a44adc1c230f8f9e7bb25131a861f17313fe9be06ab7d4a158b80b95d9a8642c76b12deccd62b271275cb3c034528f