cerberus | 442d3fb99a211111ddc64ed58af40f9a2acafb57ec80e36723ac8457f3859e24 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Aleyna_Tilki_Ifsa.apk
Size 2.7MB
Sample211013-ynn8csfafr
SHA256 442d3fb99a211111ddc64ed58af40f9a2acafb57ec80e36723ac8457f3859e24
MD5 49813dea66420480e4e10a123a53f559
SHA1 c29f97939719e98f20ac84743139f243debf39d8
SHA512 be220e47a6d6c0d10a17e851f6f36e9a9ee42ae50551835c3a18b16c9f4d70fb29b194ec131424d7baccaeff9895ab544e4ad03d5e2ae5f7efa1ef6b7fcb7d1d
MD5 SHA1 SHA512

Score

10^/10

cerberus android banker evasion infostealer obfuscation rat trojan

Malware Config

Extracted

Family

cerberus

C2

http://161.97.68.93

Targets

- Target
  Aleyna_Tilki_Ifsa.apk
- Size 2.7MB
- SHA256 442d3fb99a211111ddc64ed58af40f9a2acafb57ec80e36723ac8457f3859e24
- MD5 49813dea66420480e4e10a123a53f559
- SHA1 c29f97939719e98f20ac84743139f243debf39d8
- SHA512 be220e47a6d6c0d10a17e851f6f36e9a9ee42ae50551835c3a18b16c9f4d70fb29b194ec131424d7baccaeff9895ab544e4ad03d5e2ae5f7efa1ef6b7fcb7d1d
- MD5 SHA1 SHA512
Score

10^/10

cerberus banker evasion infostealer obfuscation rat trojan
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cerberusbankerevasioninfostealerobfuscationrattrojan