Overview

overview

10

Static

static

6

b46a0305df...18.apk

android-9-x86

10

b46a0305df...18.apk

android-10-x64

10

b46a0305df...18.apk

android-11-x64

Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    30-11-2024 02:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b46a0305dfbcb341dad439a88cd67c56_JaffaCakes118.apk

  • Size

    3.1MB

  • MD5

    b46a0305dfbcb341dad439a88cd67c56

  • SHA1

    3ddf314f3d8c66037fcc76cb7a4148d11a55e9e3

  • SHA256

    29149f72818601df2e9df222a3167c832e9c4caf0d9e9c281889336200d68dd7

  • SHA512

    99cb4d86f139aa30860b0ffbfad98d72f95f018ab2bf0f611719dabd384eac81b5f0e8dcbd6eeb9b4c4dc9e1e25381f16aea5adfe9f7d21cf8ecee3f28f01488

  • SSDEEP

    49152:y3ZBJkFMbk0y9HCZfDEjU8qCjWgQ0HRNXOz4DiWrbT9HqI68bOJf+b15YGROOUvI:yuGbk19Kb9Gc84UiWrB6861I1Kb9w

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://ratrentalservice.com

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • raven.tenant.forum
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4261
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/raven.tenant.forum/app_DynamicOptDex/rWQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/raven.tenant.forum/app_DynamicOptDex/oat/x86/rWQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4288

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/raven.tenant.forum/app_DynamicOptDex/oat/rWQ.json.cur.prof
    Filesize

    904B

    MD5

    aa68d8f19499e74389a1123b26591f6f

    SHA1

    6d12787b0ff5c5f0359afe5d3170c50b8868a3c8

    SHA256

    99ec076fd4b5683c3c761d3f8213cbd1bf5508e724bbc60449c3182437a002ef

    SHA512

    070c903e5e4d98da78c5b1536bfff7a2cd13d8ad7873e81a67492d981e4c0c958acd20f97de44350d7e7e91e6725f08df3b35de4079d203c93336060724053be

    Download Submit

  • /data/data/raven.tenant.forum/app_DynamicOptDex/rWQ.json
    Filesize

    801KB

    MD5

    3f39379292e5fc636eb29371ba013bd2

    SHA1

    091c69d1fda980b18ea7c2a413ddde7ec5854137

    SHA256

    8982186196bcc0a336386d27d4c3de1c3e43b10aad0fecbecd706160b9cbd117

    SHA512

    67f7e0e44c53ce9dff01f0be087b508a3f7f25761e1c23b5e61acbfc8b9c32d4625c552a1c72d2fc10e805179028eabf0fb7871246086ecca685d717ef0476f9

    Download Submit

  • /data/data/raven.tenant.forum/app_DynamicOptDex/rWQ.json
    Filesize

    801KB

    MD5

    d03fead3b34e2fc98d5e1f86a53eb5c3

    SHA1

    6d8a9a7939c518ffde2528a42e9e37a816dc41d6

    SHA256

    58c75abc38546efd7237941d1c9732fe6c65dfd56852eb2cb633f22859203a46

    SHA512

    4921f1bdf7f20ad63f00f7e38dd97f30c6e3c9d59d7a41fc3fa848f0d48aaff048c5f1e104e2fbec7f0307fedb000e0920e604859bf8ef55d652ef224e1d9702

    Download Submit

  • /data/user/0/raven.tenant.forum/app_DynamicOptDex/rWQ.json
    Filesize

    801KB

    MD5

    83de487436714916327ad33fc2ffa7cb

    SHA1

    478b1a093824c40e7dc5f6b88650d06cf2362d4b

    SHA256

    e8977f529770998108569031f4a93513de6aa2426963d6cd9c2643d7bd420aae

    SHA512

    f41f063c637689ba1514b25a102a92292f21db3211c2fd102a4549fbe9c8c990d95e7f5ca55b29ab62a1eea26f7f7c4d9e1571ec9b2671af69b7b3f077ca4491

    Download Submit