Analysis
-
max time kernel
176s -
max time network
137s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
29-05-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
75fe4067f1b0a3e7f30453575c47f254
-
SHA1
cc8ec6ac3178050bc10b5e5c2dd62b344eafa88c
-
SHA256
79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497
-
SHA512
f02a2ddbc45cc8f855f3832fea8fd6ab2ec08c84f5ee446f0e3fcd26689db71c8793048d2c35b6896e373a24461d969e7c589347fac7886f24ed3ba856677214
-
SSDEEP
49152:pVYesMiZMd49s6Y4nFMFErIbjcmQW//nlRDBui366+DpBIe1TQN8ytk5iWrwkZyn:pSDTTrJK/nlBqN9BuJtk5ifkZyTHekWk
Malware Config
Extracted
alienbot
http://manavgatselalesi2.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload 2 IoCs
Processes:
resource yara_rule /data/data/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json family_cerberus /data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json family_cerberus -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygpid process 4207 mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process File opened for read /proc/cpuinfo mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process File opened for read /proc/meminfo mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/oat/x86/mEcRlr.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json 4207 mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg /data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json 4231 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/oat/x86/mEcRlr.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json 4207 mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Framework service call android.app.IActivityManager.registerReceiver mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygdescription ioc process Framework service call android.app.job.IJobScheduler.schedule mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg
Processes
-
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathayg1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
PID:4207 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/oat/x86/mEcRlr.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4231
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.jsonFilesize
781KB
MD5593c7409e786f9d4010c3f50ce13db36
SHA13e00cf2164bcec1af1b3ec32be10337f8d9a9bbd
SHA25625d23efb77bbc4ec6e4c4e31c0cca056f767fb7d28b8f752e18061a8ee5d1c6e
SHA512a24a81e87cf4e7301e07f28932dbd7a4110b589971bc653bd85b042e2ecae607fba5881bf6a1ea621c72ee72d211eb8e9da5c74b6b0a478bdca0370cdeb1bc2a
-
/data/data/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.jsonFilesize
781KB
MD58d077131c8ea346f25c3701c9328297e
SHA15349312bb588844699cf7506f18d0b8df645b29e
SHA256d09334d34819d10df073afb943ba2b9603f0d70ff41d04a48a61d85b21e3bb37
SHA512bc54f1f8b9a47b3f2ca2fa9f44f5855da5004970c310b622ade37f58224b26398905ef77f5a224775c2fe6698858cca659d98afb7d02cb305d1c16f2656d0acd
-
/data/data/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/oat/mEcRlr.json.cur.profFilesize
507B
MD58014ab20920476b9297d533e054eccc0
SHA19a9fda1cba21e9f63c2685c7e513ea31b1e9422c
SHA256c8dc845623eed68e488b9c66161efacf7bf5cc6fc3b3e97a511e388a38711825
SHA51257ca39d07bcf8cb749f4e05539108d0e04198b240775dc8e90905fbbd78d3690e9e75afd5329b8676286ac0ba0294b6ce8f1ce7293f319145fe2698972409a02
-
/data/user/0/mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj/app_DynamicOptDex/mEcRlr.jsonFilesize
781KB
MD5bc1d0548e5c191103636e031e634b06d
SHA1747ae6021952a05bce7efde7c0bad2f99e175ab9
SHA256daa1d6e4ecae16d0849bbfbc679418cfdb9f30fa2da5acf5de98d75a5cc2e659
SHA5124eb3a48acbaa6a193726de6bd73db4c58f0501ac5108e1150e440b22fbc272b5efcc6731f75fa46ec01dd0e6e13d73c7989ece7fb65b6fa2d87d4dc7401af846