Analysis
-
max time kernel
2067580s -
platform
android_x86 -
resource
android-x86-arm -
submitted
13-10-2021 19:57
Static task
static1
Behavioral task
behavioral1
Sample
Android build_obf.apk
Resource
android-x86-arm
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Android build_obf.apk
Resource
android-x64-arm64
0 signatures
0 seconds
General
-
Target
Android build_obf.apk
-
Size
2.6MB
-
MD5
70f36562f58abbdf83212960f304d528
-
SHA1
8448de6901e3aa62d9e6b2d59bfc7c2c9c4664b5
-
SHA256
d7480b9bc123f459d8bd1045f2e1d3b26867c39970290f3007d0b8b79cc1908d
-
SHA512
214671b9742aeafa6d72fd2749a9455e4b0c5d7bd851d845fb4114ba5ef09f1e95ba3331ecae046082344767ee186d2b51fd822595e56171d8b763a3d493a7a6
Malware Config
Extracted
Family
cerberus
C2
http://194.163.187.220
Signatures
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mammal.shrug/app_DynamicOptDex/SG.json 5030 com.mammal.shrug /data/user/0/com.mammal.shrug/app_DynamicOptDex/SG.json 5054 /system/bin/dex2oat /data/user/0/com.mammal.shrug/app_DynamicOptDex/SG.json 5030 com.mammal.shrug -
Uses reflection 1 IoCs
description pid Process Invokes method android.content.pm.PackageManager.isInstantApp 5030 com.mammal.shrug