Analysis
-
max time kernel
197481s -
max time network
133s -
platform
android_x86_64 -
resource
android-x86_64 -
submitted
07-03-2021 08:18
Static task
static1
Behavioral task
behavioral1
Sample
ChromeUpdate6.3.4.apk
Resource
android-x86_64
android_x86_64
0 signatures
0 seconds
General
-
Target
ChromeUpdate6.3.4.apk
-
Size
2.7MB
-
MD5
6fa1f3e911a13daa76290b7d70d88311
-
SHA1
428a4aaed4969882d8ca852edb6613ca6ad3001b
-
SHA256
53af082168268e74d65174048dab031269cf14ab383bf8e135b4b98e8c8fc001
-
SHA512
6f23c35cc81c0a13633f457014473511168b834639ef3f7f96c7941b949372a197fdaf7abb060d2b0d35178d49a5b88326376e90c763115cefe86ae793c56707
Malware Config
Extracted
Family
cerberus
C2
http://santrader.ga
Signatures
-
Processes:
appear.dove.wildpid process 3611 appear.dove.wild -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
appear.dove.wildioc pid process /data/user/0/appear.dove.wild/app_DynamicOptDex/sObSd.json 3611 appear.dove.wild /data/user/0/appear.dove.wild/app_DynamicOptDex/sObSd.json 3611 appear.dove.wild -
Uses reflection 25 IoCs
Processes:
appear.dove.wilddescription pid process Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method android.content.res.AssetManager.addAssetPath 3611 appear.dove.wild Invokes method android.app.ContextImpl.getAssets 3611 appear.dove.wild Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method android.content.res.AssetManager.open 3611 appear.dove.wild Invokes method java.io.FilterInputStream.read 3611 appear.dove.wild Invokes method java.io.FilterInputStream.read 3611 appear.dove.wild Invokes method java.io.BufferedInputStream.read 3611 appear.dove.wild Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method java.io.BufferedInputStream.close 3611 appear.dove.wild Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method java.lang.String.getBytes 3611 appear.dove.wild Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method java.io.FileOutputStream.write 3611 appear.dove.wild Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method java.io.FilterOutputStream.close 3611 appear.dove.wild Invokes method android.app.ActivityThread.currentActivityThread 3611 appear.dove.wild Acesses field android.app.ActivityThread.mPackages 3611 appear.dove.wild Invokes method java.lang.reflect.Field.get 3611 appear.dove.wild Invokes method java.lang.Object.getClass 3611 appear.dove.wild Invokes method java.lang.ref.Reference.get 3611 appear.dove.wild Invokes method java.lang.ref.Reference.get 3611 appear.dove.wild Acesses field android.app.LoadedApk.mClassLoader 3611 appear.dove.wild Invokes method java.lang.reflect.Field.get 3611 appear.dove.wild Acesses field android.app.LoadedApk.mClassLoader 3611 appear.dove.wild -
64 IoCs
Processes:
appear.dove.wildpid process 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild 3611 appear.dove.wild