Resubmissions

15-10-2021 12:28

211015-pnqlraahe2 10

15-10-2021 12:25

211015-plm3vaahd5 7

Analysis

  • max time kernel
    2213388s
  • max time network
    58s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    15-10-2021 12:28

General

  • Target

    Aleyna_Tilki_Ifsa.apk

  • Size

    3.1MB

  • MD5

    63e94222fde7ff90ddd81341c409f148

  • SHA1

    4a911259cc5fb7b3312fb5c41435d05819cf4b81

  • SHA256

    fdd9db26f25d0d784b5692003f46320d8400266b6573d5c8ec6dd6c4e2e7bc72

  • SHA512

    aad056f2a5c4ef62e5810cc56d29e618de7f4d2c263307759306a2ff9060cb6959b94fa21cbc68fef13ef2f430fa4ef2df11e5e751cbc909a44bbdc5b86238f9

Malware Config

Extracted

Family

cerberus

C2

http://161.97.68.93

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 2 IoCs

Processes

  • com.coast.rather
    1⤵
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:3661

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads