cerberus | 1c40aac07919178b4a1250a5d91cde334667174c436498adf6718a32b85fd261 | Triage™

Resubmissions

09/10/2021, 10:10

211009-l7vs2afbhl10

09/10/2021, 10:07

211009-l5m1eafbc77

Analysis

max time kernel
1686760s
max time network
55s
platform
android_x64
resource
android-x64
submitted
09/10/2021, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yerli_Gizli_Cekim_Ifsa_Videolar.apk
Size 2.9MB
Sample211009-l7vs2afbhl
SHA256 1c40aac07919178b4a1250a5d91cde334667174c436498adf6718a32b85fd261
MD5 7af4f6aeb49181e6e9795596570772eb
SHA1 46c3db01504a26d0b096de13f1c0c1f9ceb632e7
SHA512 46297100a0c87a0d1940df66d11f52a07dcedd773a7ecb1f958c4f63fe9c3e7396cabd020c5480c3cde1bcc8703dcc8296917ad9efce0b51b9adb8a224aa3bae
MD5 SHA1 SHA512

Score

10^/10

cerberus banker evasion infostealer obfuscation rat trojan

Malware Config

Extracted

Family

cerberus

C2

http://109.205.182.47

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.text.gun/app_DynamicOptDex/EpJasGj.json	3778	com.text.gun
/data/user/0/com.text.gun/app_DynamicOptDex/EpJasGj.json	3778	com.text.gun
/product/app/webview/webview.apk	3778	com.text.gun
/product/app/webview/webview.apk	3778	com.text.gun

Uses reflection 3 IoCs

description	pid	Process
Invokes method android.content.Context.bindServiceAsUser	3778	com.text.gun
Invokes method android.content.Context.bindServiceAsUser	3778	com.text.gun
Invokes method android.content.Context.bindServiceAsUser	3778	com.text.gun

com.text.gun
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3778

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads