General

  • Target

    99ff688d1a2b535bb025eaf91367d6d9_JaffaCakes118

  • Size

    3.0MB

  • Sample

    241125-h2p4ta1mbm

  • MD5

    99ff688d1a2b535bb025eaf91367d6d9

  • SHA1

    d3bd5fcca0285244d6c4d56f9e87c481fdc9a85c

  • SHA256

    da6ad6b01c00868cd5f7d60aecac9b9d3b651e83c8e71fbfe8e2922fedf84575

  • SHA512

    4b76a3250e2c12b6d7821f8799a9bbaba18ce81ffc4de643460e0d1d1c228022f5753c7aa04ef9d0d72e5b87fccc446c168b3f47b4543663405d51f39224eb4e

  • SSDEEP

    49152:tzRvJXKb1k0kaBGISz9uw6QdGyuKYCHfJBA3JNa4n0XG0nqGKqa7Jhezy/tKo8:k+0LBGIQ9fbdbQAEZNH0XpnqG8k3

Malware Config

Extracted

Family

cerberus

C2

http://somsombaba.xyz

Targets

    • Target

      99ff688d1a2b535bb025eaf91367d6d9_JaffaCakes118

    • Size

      3.0MB

    • MD5

      99ff688d1a2b535bb025eaf91367d6d9

    • SHA1

      d3bd5fcca0285244d6c4d56f9e87c481fdc9a85c

    • SHA256

      da6ad6b01c00868cd5f7d60aecac9b9d3b651e83c8e71fbfe8e2922fedf84575

    • SHA512

      4b76a3250e2c12b6d7821f8799a9bbaba18ce81ffc4de643460e0d1d1c228022f5753c7aa04ef9d0d72e5b87fccc446c168b3f47b4543663405d51f39224eb4e

    • SSDEEP

      49152:tzRvJXKb1k0kaBGISz9uw6QdGyuKYCHfJBA3JNa4n0XG0nqGKqa7Jhezy/tKo8:k+0LBGIQ9fbdbQAEZNH0XpnqG8k3

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Cerberus family

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the phone number (MSISDN for GSM devices)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.