Resubmissions

15/04/2024, 19:09

240415-xt4dssdg4510

07/12/2021, 21:35

211207-1fk7vadbbm10

General

  • Target
    Aleyna_Tilki_Ifsa.apk
  • Size 2.2MB
  • Sample211207-1fk7vadbbm
  • SHA256 731c0da8d74adbb557a0abd4ec2aa6c61e09d429560d76549881f08e564b27cd
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • cerberus

C2
  • http://31.187.74.114

Targets

    • Target
      Aleyna_Tilki_Ifsa.apk
    • Size 2.2MB
    • SHA256 731c0da8d74adbb557a0abd4ec2aa6c61e09d429560d76549881f08e564b27cd
    • MD5 SHA1 SHA512
    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks