Analysis
-
max time kernel
3608316s -
max time network
65s -
platform
android_x86_64 -
resource
android-x86_64 -
submitted
15-04-2021 19:45
Static task
static1
Behavioral task
behavioral1
Sample
95c671b71bee5fdaec601b89e3ef43c30a606d117c80658776d9a50516f1c414.apk
Resource
android-x86_64
android_x86_64
0 signatures
0 seconds
General
-
Target
95c671b71bee5fdaec601b89e3ef43c30a606d117c80658776d9a50516f1c414.apk
-
Size
3.4MB
-
MD5
0a773cbfefc68911d0e2bf3428303ad0
-
SHA1
2a29258e26fc7b44aeef9d68fe8d52082280e800
-
SHA256
95c671b71bee5fdaec601b89e3ef43c30a606d117c80658776d9a50516f1c414
-
SHA512
aca5368df9d5588f608b0982d635ad58f8e93f755f4888218614cb7b6f76b119dad9645c2b869e3cc31958961fc70e61e980ee07a9805aa03b4c3606a2b5ad64
Malware Config
Extracted
Family
cerberus
C2
http://107.172.142.199/
Signatures
-
Processes:
search.truth.weirdpid process 3613 search.truth.weird -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
search.truth.weirdioc pid process /data/user/0/search.truth.weird/app_DynamicOptDex/pfHZ.json 3613 search.truth.weird /data/user/0/search.truth.weird/app_DynamicOptDex/pfHZ.json 3613 search.truth.weird -
Uses reflection 27 IoCs
Processes:
search.truth.weirddescription pid process Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method android.content.res.AssetManager.addAssetPath 3613 search.truth.weird Invokes method android.app.ContextImpl.getAssets 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method android.content.res.AssetManager.open 3613 search.truth.weird Invokes method java.io.FilterInputStream.read 3613 search.truth.weird Invokes method java.io.FilterInputStream.read 3613 search.truth.weird Invokes method java.io.BufferedInputStream.read 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method java.io.BufferedInputStream.close 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method java.lang.String.getBytes 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method java.io.FileOutputStream.write 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method java.io.BufferedInputStream.close 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method java.io.FilterOutputStream.close 3613 search.truth.weird Invokes method android.app.ActivityThread.currentActivityThread 3613 search.truth.weird Acesses field android.app.ActivityThread.mPackages 3613 search.truth.weird Invokes method java.lang.reflect.Field.get 3613 search.truth.weird Invokes method java.lang.Object.getClass 3613 search.truth.weird Invokes method java.lang.ref.Reference.get 3613 search.truth.weird Invokes method java.lang.ref.Reference.get 3613 search.truth.weird Acesses field android.app.LoadedApk.mClassLoader 3613 search.truth.weird Invokes method java.lang.reflect.Field.get 3613 search.truth.weird Acesses field android.app.LoadedApk.mClassLoader 3613 search.truth.weird