Analysis
-
max time kernel
58s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
30-12-2024 04:36
General
-
Target
JaffaCakes118_6cebe6deeb4918f0cd0ca448a2c40e068bc0e374afac9bc99a79559289ab7f3c.apk
-
Size
4.7MB
-
MD5
804db0c00316f29a0e40b4b8d73068b9
-
SHA1
89e9092f0376ce1c9e9383d53050526af815ce7f
-
SHA256
6cebe6deeb4918f0cd0ca448a2c40e068bc0e374afac9bc99a79559289ab7f3c
-
SHA512
c54f8f2b43d810b0c334aaf099087f2517bfe6a1f1f973ba6469d71f885f55275d1718607284bbdfa7179ec10ad2384fd1b910f404051c8e0a2bbeceb2b079c8
-
SSDEEP
98304:ygozeS0d4TU7kA4Pgz7WItf0U1yvL2wJ/arlBSMIxQZ+wa4ZdR:ygozePtkA4PQ7JJr1yvLDJ/arlBGODag
Malware Config
Extracted
cerberus
http://bestofjazhe.xyz
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
joy.desert.kiwi1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5ddf9b12a5bfedd68d78e2529c24abe3b
SHA12ada703d7dde11823e2b45b831caff5a6af2f107
SHA256490f0e17b876db54a8050c9fd83d62c4dcf22e3f7e0d2f592604633c5dd9e611
SHA512045eb714f43c0d0df88073c621fd6b3c1bc4e10e3ecd1bf15619ffedeefab6b59c606f5477718cca9a37c599c6dadadebc7295ee8b4670bc804ca1dbfb117fae
-
Filesize
784KB
MD508a68cb848ab5e884ff545e6b055b823
SHA1360f9162934353962121e07175d24ebd520b650a
SHA2561669c81613e260ca38c5317bd790bef18f6de4366018c7e946a3d5a522ae4e03
SHA5125358eec2562fc698a3f3b24383242b632631a17197a2f1434f3d4ad4d71a35c1453cafb9775c200eb0d74143121c8cbfe9a881a07159b495e9c13a2b8eb8b920
-
Filesize
278B
MD52374e386ad174dad911cab91863ede19
SHA19bb9009f5a71d967b4255f6837baa8ecb224f0aa
SHA2562650757d1a6c5baaa7c3971598868fa4b912d33a9c170a3d2f21257909903a69
SHA512f794961c60f36fdfaace081315840161268153be30bc08c34664733fbb243f09fd582bffe189dd411eca1d4e94d166ed8e63d198622db9ce1012c454b30d3861