Analysis
-
max time kernel
2156577s -
max time network
46s -
platform
android_x64 -
resource
android-x64 -
submitted
14-10-2021 20:41
Static task
static1
Behavioral task
behavioral1
Sample
Androidupdate(1).apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
Androidupdate(1).apk
-
Size
2.6MB
-
MD5
77b5788f04030d138879e3080e712078
-
SHA1
880e365f17271d4492f8cca8f86c40835e87fc15
-
SHA256
b08ead4e5ecc18f14e6a92ad09e9ec7dfdfda91d673c0829769f35c76eea2f1b
-
SHA512
ea19c21eddbcbe7bdd3d9fbf0728dc83c0f34a6e30d7227d4d916d0f023007370c38c79bfacb73b6a0102a799a06751364b3c1663818883e2aecd9dcd2c8ec7b
Malware Config
Extracted
Family
cerberus
C2
http://20.90.106.208/
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json 3644 com.polar.mad /data/user/0/com.polar.mad/app_DynamicOptDex/lECnmhp.json 3644 com.polar.mad /product/app/webview/webview.apk 3644 com.polar.mad /product/app/webview/webview.apk 3644 com.polar.mad -
Uses reflection 11 IoCs
description pid Process Invokes method android.content.Context.bindServiceAsUser 3644 com.polar.mad Invokes method android.content.Context.bindServiceAsUser 3644 com.polar.mad Invokes method android.content.Context.bindServiceAsUser 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.polar.mad