General

  • Target

    e47462b6c50a6e16a1f1fc99f5c2c96a748296ec756144618215aebf1805ae3e.apk

  • Size

    2.8MB

  • Sample

    211011-ymq1kaaaal

  • MD5

    c05946a73facef6df631d6d550234fb0

  • SHA1

    8fe54373dac56c98e6853e9df9e8ddb5fd5f74c8

  • SHA256

    e47462b6c50a6e16a1f1fc99f5c2c96a748296ec756144618215aebf1805ae3e

  • SHA512

    e71e45d93f924b55a15cd32e781dd778371a16b8badaef1725d6943196d3dfb0a0bbb87e18357ce241ef5856ee25c41c5bb4b2e2091c69975240a7330c9a390e

Malware Config

Extracted

Family

cerberus

C2

http://194.163.139.138

Targets

    • Target

      e47462b6c50a6e16a1f1fc99f5c2c96a748296ec756144618215aebf1805ae3e.apk

    • Size

      2.8MB

    • MD5

      c05946a73facef6df631d6d550234fb0

    • SHA1

      8fe54373dac56c98e6853e9df9e8ddb5fd5f74c8

    • SHA256

      e47462b6c50a6e16a1f1fc99f5c2c96a748296ec756144618215aebf1805ae3e

    • SHA512

      e71e45d93f924b55a15cd32e781dd778371a16b8badaef1725d6943196d3dfb0a0bbb87e18357ce241ef5856ee25c41c5bb4b2e2091c69975240a7330c9a390e

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

MITRE ATT&CK Matrix

Tasks