General

  • Target
    Hadise_Ifsa.apk
  • Size 2.2MB
  • Sample211207-1flhlsdbbn
  • SHA256 4aa281c6840591127f3e01d89f0c5da4e17fb46132486a871c989c5025f04cac
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • cerberus

C2
  • http://51.81.186.22

Targets

    • Target
      Hadise_Ifsa.apk
    • Size 2.2MB
    • SHA256 4aa281c6840591127f3e01d89f0c5da4e17fb46132486a871c989c5025f04cac
    • MD5 SHA1 SHA512
    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks