Overview

overview

10

Static

static

6

0652ee469a...18.apk

android-9-x86

10

0652ee469a...18.apk

android-10-x64

10

0652ee469a...18.apk

android-11-x64

Analysis

  • max time kernel
    63s
  • max time network
    155s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    01-10-2024 15:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0652ee469af5aadaf31b9503b93ebe55_JaffaCakes118.apk

  • Size

    3.0MB

  • MD5

    0652ee469af5aadaf31b9503b93ebe55

  • SHA1

    a6643599bb94cfd47ca950238e7848a6c9cbf6b6

  • SHA256

    db7f48b7aed2759b59ce498986dd39ff62b30a5fd54bd3d63c5e361e1b83104a

  • SHA512

    f14c7e13004c4e480c991576283129b18c9f4d992d1993d369178a2a7401f16831550968adbbd399192548291654e3a950775c6b66f87de254f43f607e749536

  • SSDEEP

    49152:W1oRt/G5dy1fGmfHZ5onshewk0UWzQ8a1womS+VUmpQl4Eg5mCdpgxd1+kmO8TJx:TG5k1LhWsTk3Wk8iwYq4gpdSxL+k98tx

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://ratrentalservice.com

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • bless.trap.alien
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4255
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bless.trap.alien/app_DynamicOptDex/fAL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/bless.trap.alien/app_DynamicOptDex/oat/x86/fAL.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4280

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/bless.trap.alien/app_DynamicOptDex/fAL.json
    Filesize

    741KB

    MD5

    7c6243be044e9315f0edd96fd29707b8

    SHA1

    aba5f07d9f5d35887cd8ccb5d43f023393bc8c17

    SHA256

    bd05359d483e424cd61260d0c306efdae1eab5d32494f42fece21a86df8bf7f2

    SHA512

    29f4bb7618e2d1ff8f790aa54bcd48338e61e9b92d52cd3104dc176615dd82c66ee00c84224cb9ecc55d69a8505f872676514ed456b318522a1bf8ad75c4ea5e

    Download Submit

  • /data/data/bless.trap.alien/app_DynamicOptDex/fAL.json
    Filesize

    741KB

    MD5

    8597aa59c1c0d21d9aa22ca35b6dd790

    SHA1

    b9a290bbed9e6b97f669f08ae9742b8e7ff9f926

    SHA256

    010861fb19370e7b951d204a0cb52d342919863add8bf71487515870843f63ec

    SHA512

    c7ea4280d47ffb6a4d80145af968ce1010306c7144fcc71db858ccaf7385b1afb869ba386e2b389103b087663b6b4d36727498e51a40fc072e09d13b4a74f9ba

    Download Submit

  • /data/data/bless.trap.alien/app_DynamicOptDex/oat/fAL.json.cur.prof
    Filesize

    893B

    MD5

    26f20a765e484e48f11634c0359c9950

    SHA1

    f97362f478885bd1f2ed683e2dba7210117e95e0

    SHA256

    4dabbdc80c58a30268c01912c833e1ea85ea515bde1e15ab2adba396a32ca2b5

    SHA512

    436bec0975ce4942d4b696ae7318e0bc58d2a20002da65ca856392d3d1f89bf1f59869718edd2b06c44fe0b7167196be78e16ea7f3a9f1d6ba34a2df31d3478b

    Download Submit

  • /data/user/0/bless.trap.alien/app_DynamicOptDex/fAL.json
    Filesize

    741KB

    MD5

    1a00a81c70b05f6d72a886742e49d018

    SHA1

    ad913064a5d24b062854716b627e47ffc62082e9

    SHA256

    f2435d405401a36026b63293340e3cb6f986d71b5d1205f1e9ce5eca748351d2

    SHA512

    292417ee83b02e8f04da0fc24049418a60e67720180e26dcd5a1d46a82d3e33e90b4f5124d98ac2a1ab044de3b501dabacbd34b3e03d0cc43a3c732c5b4a3199

    Download Submit