Overview

overview

10

Static

static

6

99ff688d1a...18.apk

android-9-x86

10

99ff688d1a...18.apk

android-10-x64

10

99ff688d1a...18.apk

android-11-x64

Analysis

  • max time kernel
    64s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    25-11-2024 07:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    99ff688d1a2b535bb025eaf91367d6d9_JaffaCakes118.apk

  • Size

    3.0MB

  • MD5

    99ff688d1a2b535bb025eaf91367d6d9

  • SHA1

    d3bd5fcca0285244d6c4d56f9e87c481fdc9a85c

  • SHA256

    da6ad6b01c00868cd5f7d60aecac9b9d3b651e83c8e71fbfe8e2922fedf84575

  • SHA512

    4b76a3250e2c12b6d7821f8799a9bbaba18ce81ffc4de643460e0d1d1c228022f5753c7aa04ef9d0d72e5b87fccc446c168b3f47b4543663405d51f39224eb4e

  • SSDEEP

    49152:tzRvJXKb1k0kaBGISz9uw6QdGyuKYCHfJBA3JNa4n0XG0nqGKqa7Jhezy/tKo8:k+0LBGIQ9fbdbQAEZNH0XpnqG8k3

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://somsombaba.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • estate.cake.crush
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4247
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/estate.cake.crush/app_DynamicOptDex/oat/x86/pMO.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4276

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/estate.cake.crush/app_DynamicOptDex/oat/pMO.json.cur.prof
    Filesize

    895B

    MD5

    49ad3beebce44b65a8e49ab3be7ce367

    SHA1

    61462de5b46a794e4f27529905226b51889dcf45

    SHA256

    a6d69eb5c66b08a9feb98fd717b07ea710c7f7d60e2e6342f19d69e1fb540678

    SHA512

    b29abf252433153e801796f3d999d33896e6a0cb0e5e51265d24602a24f6096c86e2cff3891143cb018aa55d4da431f58a5b7feb0912f8a5e6d2f14227258f34

    Download Submit

  • /data/data/estate.cake.crush/app_DynamicOptDex/pMO.json
    Filesize

    709KB

    MD5

    2e04f11062c2bbda6c3cdcf0a6fae086

    SHA1

    b4cb7d9433108de2675e01097402d853fc332d39

    SHA256

    281129f92d402aa2b5884e597eda60027d5695efd859b29cc3e59bd88c06f6b7

    SHA512

    3b616084fadcbe0f78272b934939dd30fa8481042de58307dc299af2250fd158a3610366863597674335b624d6c1e9d922729760f33f0e989ad7f75670d0936e

    Download Submit

  • /data/data/estate.cake.crush/app_DynamicOptDex/pMO.json
    Filesize

    709KB

    MD5

    a81b540a1b6225eb86374cf85db257bf

    SHA1

    76f878e135cea17e3a7e3e7808e4be1b774a30ea

    SHA256

    cc76bfd537f15a42f05eadbffab3284bf030cc7e9b7eb339598d42c832f76ebb

    SHA512

    80a949eb2207193b9981270c18df16fff854e2d8a6e4351bbe91541d36077bb834a76a3234d8ae0dd2058ad8e034ee88e366820ac6d0ce9be9613cd4e4202e0d

    Download Submit

  • /data/user/0/estate.cake.crush/app_DynamicOptDex/pMO.json
    Filesize

    709KB

    MD5

    e511bcc895c4da68f2c7eabfb627398d

    SHA1

    2052f3807daddec66e283e7dc60b7b3e635959f5

    SHA256

    9501ff366b1bc860183bb2cb86f2cccab87b0419e5168d143d1395f0d4da1823

    SHA512

    a3eadb017b7d254ab6ff7bd5720bfa45e8e6246edcfe88eff3e865314689d7c427c8ccdb56d42ecdf3234948bd6e6537c4c94b0b8882ae174cfdb45273e5902e

    Download Submit