Analysis

  • max time kernel
    55s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    12-10-2024 08:07

General

  • Target

    39184e0c52ee804e0c0fa988193e0c1f_JaffaCakes118.apk

  • Size

    119KB

  • MD5

    39184e0c52ee804e0c0fa988193e0c1f

  • SHA1

    c91dca0e425ab7a1e85d14ed54033a1a094308f5

  • SHA256

    e5058aa3e87cc6bb71fdcb959554e14f5354da24b23350296e406d3f1559a1c3

  • SHA512

    fd5503077351c6a51e606c92007994c88b8b9c3a45bb01db8ad5b381d2eef58364caefdde81e2332932bf1d467e3f327246a08d0029ba66408ab719793002836

  • SSDEEP

    3072:aEo0zISHXD0zMegVtqYLlCVhfLb0Dcdg9xxAhsghsH010K0f:afeISHXDEJgXPLIhfLADcS9xxArq010h

Malware Config

Extracted

Family

cerberus

C2

https://bensiznekadarmutluolabilirsinki.club

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.zljzbylqhalslok.xapkyp
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4996

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads