General
-
Target
YERLİ_İFŞA_VİDEOLARI_PORNO_obf.apk
-
Size
3.0MB
-
Sample
210805-1qxxv8fqpx
-
MD5
05e36d50dbe36872d1115092eea516d1
-
SHA1
571d42378f65eb150acbe290040220d21b3492f1
-
SHA256
5e0a6d2f9215ec44c9e486543efb5317c9b68875dfc762b4e5d526481cd05f0f
-
SHA512
868101e785dae91ef26c0efc4aed59c203f63fbce35810ccef7ebb25112958381b81a95724b45e372d09bda45688a32570d66cb0737e95f9e40e1ae90ca4038e
Malware Config
Extracted
cerberus
http://194.163.159.65
Targets
-
-
Target
YERLİ_İFŞA_VİDEOLARI_PORNO_obf.apk
-
Size
3.0MB
-
MD5
05e36d50dbe36872d1115092eea516d1
-
SHA1
571d42378f65eb150acbe290040220d21b3492f1
-
SHA256
5e0a6d2f9215ec44c9e486543efb5317c9b68875dfc762b4e5d526481cd05f0f
-
SHA512
868101e785dae91ef26c0efc4aed59c203f63fbce35810ccef7ebb25112958381b81a95724b45e372d09bda45688a32570d66cb0737e95f9e40e1ae90ca4038e
Score10/10-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings.
-
Reads name of network operator
Uses Android APIs to discover system information.
-