General

  • Target

    Android Güncelleme.apk

  • Size

    4.6MB

  • Sample

    210805-vg59vhcxga

  • MD5

    47d5d8bb66d512d703b3af3cf05d5452

  • SHA1

    39836f1d9151687da9d3b1609942e2ed51e32cf6

  • SHA256

    ec0777beb47d9844e76281ff5459fbf66c68a0abc0819f31dbe8d4c831ffd44a

  • SHA512

    db3184bb144ca7e2b6a593ffcc9e3594d321eb8f0eb6b2a5d9423ebd64ed3013c4e494cd063aa1f87808f3cdc33c11edf9e0164aaa1af872afa189848be2df15

Malware Config

Extracted

Family

cerberus

C2

http://144.126.152.229

Targets

    • Target

      Android Güncelleme.apk

    • Size

      4.6MB

    • MD5

      47d5d8bb66d512d703b3af3cf05d5452

    • SHA1

      39836f1d9151687da9d3b1609942e2ed51e32cf6

    • SHA256

      ec0777beb47d9844e76281ff5459fbf66c68a0abc0819f31dbe8d4c831ffd44a

    • SHA512

      db3184bb144ca7e2b6a593ffcc9e3594d321eb8f0eb6b2a5d9423ebd64ed3013c4e494cd063aa1f87808f3cdc33c11edf9e0164aaa1af872afa189848be2df15

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks