Resubmissions

13-10-2021 23:21

211013-3cg25afdb8 10

13-10-2021 23:17

211013-29pmssfdb6 7

Analysis

  • max time kernel
    2079796s
  • platform
    android_x86
  • resource
    android-x86-arm
  • submitted
    13-10-2021 23:21

General

  • Target

    Porno_izle.apk

  • Size

    2.7MB

  • MD5

    d00c507fc93850d691e025b56724d91d

  • SHA1

    a50258d4438d4a8272e7c0d8738440c29e34d71d

  • SHA256

    1df4a7de1532dd1787e9a8d488016323409ca8052b2afecf9855d864b6c9b315

  • SHA512

    1f508e2b08770fb0f240b2e02d194818f1a195a4bfdb72c0695f17d1690d3611724d8cd8c7642a9f3d034dccb026de7bb460d2aa8c5492091923f9bdb58c4ca4

Malware Config

Extracted

Family

cerberus

C2

http://161.97.75.127

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Uses reflection 1 IoCs

Processes

  • com.wheat.seek
    1⤵
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Uses reflection
    PID:4711
    • com.wheat.seek
      2⤵
        PID:4739
      • /system/bin/dex2oat
        2⤵
        • Loads dropped Dex/Jar
        PID:4739

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads