Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    26-11-2024 12:58

General

  • Target

    a2112d3c6b589061b7c97fc2df9ee154_JaffaCakes118.apk

  • Size

    2.8MB

  • MD5

    a2112d3c6b589061b7c97fc2df9ee154

  • SHA1

    34e5b6a7785a08570a0aac4f12f64f8cff4d8274

  • SHA256

    8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a

  • SHA512

    ed95d1ec68e4632816943595ba2a8ccb5452b9a654d3898155e02e3cb5d94f4ae115e6aa0ffc29284a5f4964623ec1c59c92cc20a77b77665faedb3e7060df1b

  • SSDEEP

    49152:qLff3a3QVebJIOj+h3QsyGGf4Hel1QfaZCL2C9eIzQPC0T5KYH/Q5xKySEX:Wa3QV6tjwQ9bzAvRQa0T5DHI5EySEX

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

C2

http://194.163.136.78

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Alienbot family
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Cerberus family
  • Cerberus payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • involve.what.draw
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4937

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/involve.what.draw/app_DynamicOptDex/QPI.json

    Filesize

    659KB

    MD5

    6d1e85f28a94032f4636fa077efc9228

    SHA1

    5ecc78d09547f6ecb7dc3bbcf981c73364bdfcb1

    SHA256

    bf91bbf1ae0b91482f6815ea67447f68bd4d93a23ac36d7cb8e4c68bb086890c

    SHA512

    7810cc1875db0f214efeee80885ae197e3ec18974e680df6c4f306977664cbb4a505c1a5888c10c5be0747579d6028ca36078bca8c73c7fd25e636e81427be8c

  • /data/data/involve.what.draw/app_DynamicOptDex/QPI.json

    Filesize

    659KB

    MD5

    4c087c1b4143eb14c750c1d042ee298c

    SHA1

    f994f56d7d3cbe5533f9172a6bc6abbec2f8292b

    SHA256

    694ed4dce22a28358dd773c56472283c7dd20a26dfd0958e558a945690608103

    SHA512

    f1df38bfa45996411ab14f32a428fc84008af6e3ff4b0ac4aa26a041f5b681576360eec87520cee4534a5154c75b0cd9173c197c89fad1e6f69dfedf22f3e829

  • /data/data/involve.what.draw/app_DynamicOptDex/oat/QPI.json.cur.prof

    Filesize

    415B

    MD5

    ee3348d49364e1e91c18b13085b1fd63

    SHA1

    159494bf613c3c4f93ed5fe35942e3860c69e37f

    SHA256

    890f07f6d12c8543966c5c1cdb381f269e7ed1cc40ff9b06c162ec21f1673402

    SHA512

    c28c7705d44dcb4dd4e67c1198926cfe6d18090cc6741b1aecbe83cc6a80403c5ae15d1ce57bab61af977c30f8571d77330bf14821b70fb7cf130ba38d105f0c