Analysis
- max time kernel
176s - max time network
132s - platform
android_x64 - resource
android-x64-arm64-20240514-en - resource tags
- submitted
29/05/2024, 14:07
General
- Target 75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118.apk
- Size 2.6MB
- Sample240529-rfdckagg7y
- SHA256 79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497
Malware Config
Extracted
-
alienbot
-
http://manavgatselalesi2.xyz
Signatures
- Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
- Cerberus
An Android banker that is being rented to actors beginning in 2019.
- Cerberus payload 1 IoCs
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
- Removes its main activity from the application launcher 1 TTPs 10 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
mzzkzccicuudsxkqnsbiycfntf.nsbdsdpssmxtrmjlnssxeaop.exmpfudabkgwtupakathaygxbj1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
mEcRlr.json
mEcRlr.json
mEcRlr.json.cur.prof