Overview

overview

10

Static

static

6

03df6d5153...18.apk

android-9-x86

10

03df6d5153...18.apk

android-10-x64

10

03df6d5153...18.apk

android-11-x64

10

Analysis

  • max time kernel
    70s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    01-10-2024 01:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    03df6d51535847b17f543b7e92d4522d_JaffaCakes118.apk

  • Size

    3.0MB

  • MD5

    03df6d51535847b17f543b7e92d4522d

  • SHA1

    04b256b3fe13865bc67c10ac2315daa347211573

  • SHA256

    056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b

  • SHA512

    2cdf413b50befc35fde51bcf1addb0a0276d637edf797a2da7305efd3f9e425dea79d40fc916b8559eb701b480cbe5c5753c4789229485ae7de529c300b4015b

  • SSDEEP

    49152:CrgwsjNyjDq+k66/NMCk6V5Dx5NHbBoPO7ftgHdh1dEgwKPwfTbnScR3/CN+F:C4YjDO6+NE6V1Lh50hgzwwfXnSzNI

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://somsombaba.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • segment.coral.blanket
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4245
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/segment.coral.blanket/app_DynamicOptDex/oat/x86/QOy.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4271

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/segment.coral.blanket/app_DynamicOptDex/QOy.json
    Filesize

    803KB

    MD5

    c491975251d44cd5e3d6cfa6a33c1663

    SHA1

    9d798814784079777416242317997df0bea0e87b

    SHA256

    063a40c99b625c031a1d8ea606e3314b1d6b1947a619147a1c4f3b117aa7c151

    SHA512

    499fa353d17b1776acf0dd301ebaed29e1acfaa49cef1078b78b359d88c5e531ff5ccf92d176d903bcb73dae873a96fb97656f4e0a8d7cbdecd90e8e55aefb9f

    Download Submit

  • /data/data/segment.coral.blanket/app_DynamicOptDex/QOy.json
    Filesize

    803KB

    MD5

    564410a68f6618918d6d0cef70d28372

    SHA1

    824e31fd757e9f45b6d67c9c2a4af9eceeb084d9

    SHA256

    3545266dfbad88144667f432ccf9073129a61110a787f3f03ef4732a906490f0

    SHA512

    f7ae7c093e740563a33e2e7eb2ed7f772f0433c2db9c58f02441fd522a055efd987eef8a7b44f425ea3b7d0014e62b4f930b9124edc70b5352da96a8a2ea7615

    Download Submit

  • /data/data/segment.coral.blanket/app_DynamicOptDex/oat/QOy.json.cur.prof
    Filesize

    910B

    MD5

    2f6d00a295181143a62d4fff75920889

    SHA1

    93aa839fe3581662dfd73b21b515fab48666015a

    SHA256

    32d33b73f37521741db1bb338f7eb7ff1c3912087ba40d86e7024d334a35cd18

    SHA512

    cb421e2088502795695662c700bec21d263542eff8031e833e4966c2b7a209e6cdb7ff463d4c7b63baddecb03bca2038055dc1eaca71e4190b9f3756ddc4f514

    Download Submit

  • /data/user/0/segment.coral.blanket/app_DynamicOptDex/QOy.json
    Filesize

    803KB

    MD5

    abccf1ef0267cac8f584de17e02f9470

    SHA1

    ea273b6f7d008e551dc78ee7a410e3b5c43edcbb

    SHA256

    1e7747f957c0e096e672bb06ad068a18fcc6cd7098173c6d9c81c9ff83d445bb

    SHA512

    27569b4dd1cfeebd6d2cc45b101531e0e58aa184e609c0a57d359841f98d49bb0d9b046991b2b3b6c312caebeef26d6a2a33107a84c3f3f469a0ad21080c2d5c

    Download Submit