Analysis Overview
SHA256
edda95f68c0cdf9f4c13e4e35211b42666c014f2c0831210b59296071139f159
Threat Level: Known bad
The file Hadise_Gizli_Cekim_Ifsa.apk was found to be: Known bad.
Malicious Activity Summary
Cerberus
Requests dangerous framework permissions
Loads dropped Dex/Jar
Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation).
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2021-12-07 21:44
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows read access to the device's phone number(s). | android.permission.READ_PHONE_NUMBERS | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2021-12-07 21:44
Reported
2021-12-07 21:50
Platform
android-x64
Max time kernel
2531306s
Max time network
19s
Command Line
Signatures
Cerberus
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json | N/A | N/A |
| N/A | /data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json | N/A | N/A |
Processes
com.home.nurse
Network
| Country | Destination | Domain | Proto |
| US | 51.81.186.22:80 | tcp | |
| US | 1.1.1.1:853 | tcp | |
| US | 216.239.35.8:123 | time.android.com | udp |
Files
/data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json
| MD5 | 9a60c0c1260622d9347a587b119a181e |
| SHA1 | 9614ee011972253c5a7a6080392d0224e4911ddf |
| SHA256 | e7b65381c26dc596ecb6ebe077316a50a117a73281175be2e0d3781d66ad6951 |
| SHA512 | f428766663bb6e7b20292b2ed80b6fc5194a84e994e8c41ac539669fcd9dc4db7f4c09cc899f22b5c4f02abb7caac8a37c0d58849f76c11834a37678ca7a6f53 |
/data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json
| MD5 | 9a60c0c1260622d9347a587b119a181e |
| SHA1 | 9614ee011972253c5a7a6080392d0224e4911ddf |
| SHA256 | e7b65381c26dc596ecb6ebe077316a50a117a73281175be2e0d3781d66ad6951 |
| SHA512 | f428766663bb6e7b20292b2ed80b6fc5194a84e994e8c41ac539669fcd9dc4db7f4c09cc899f22b5c4f02abb7caac8a37c0d58849f76c11834a37678ca7a6f53 |
Analysis: behavioral2
Detonation Overview
Submitted
2021-12-07 21:44
Reported
2021-12-07 21:53
Platform
android-x64
Max time kernel
2531457s
Max time network
112s
Command Line
Signatures
Cerberus
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json | N/A | N/A |
| N/A | /data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json | N/A | N/A |
Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation).
| Description | Indicator | Process | Target |
| Framework API call | android.hardware.SensorManager.registerListener | N/A | N/A |
Processes
com.home.nurse
Network
| Country | Destination | Domain | Proto |
| US | 1.1.1.1:853 | tcp | |
| US | 216.58.214.10:80 | play.googleapis.com | tcp |
| US | 216.239.35.8:123 | time.android.com | udp |
| US | 51.81.186.22:80 | 51.81.186.22 | tcp |
Files
/data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json
| MD5 | 9a60c0c1260622d9347a587b119a181e |
| SHA1 | 9614ee011972253c5a7a6080392d0224e4911ddf |
| SHA256 | e7b65381c26dc596ecb6ebe077316a50a117a73281175be2e0d3781d66ad6951 |
| SHA512 | f428766663bb6e7b20292b2ed80b6fc5194a84e994e8c41ac539669fcd9dc4db7f4c09cc899f22b5c4f02abb7caac8a37c0d58849f76c11834a37678ca7a6f53 |
/data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json
| MD5 | 9a60c0c1260622d9347a587b119a181e |
| SHA1 | 9614ee011972253c5a7a6080392d0224e4911ddf |
| SHA256 | e7b65381c26dc596ecb6ebe077316a50a117a73281175be2e0d3781d66ad6951 |
| SHA512 | f428766663bb6e7b20292b2ed80b6fc5194a84e994e8c41ac539669fcd9dc4db7f4c09cc899f22b5c4f02abb7caac8a37c0d58849f76c11834a37678ca7a6f53 |
Analysis: behavioral3
Detonation Overview
Submitted
2021-12-07 21:44
Reported
2021-12-07 21:54
Platform
android-x64
Max time kernel
2531500s
Max time network
55s
Command Line
Signatures
Cerberus
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json | N/A | N/A |
| N/A | /data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json | N/A | N/A |
Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation).
| Description | Indicator | Process | Target |
| Framework API call | android.hardware.SensorManager.registerListener | N/A | N/A |
Processes
com.home.nurse
Network
| Country | Destination | Domain | Proto |
| US | 51.81.186.22:80 | tcp | |
| US | 1.1.1.1:853 | tcp | |
| US | 216.239.35.0:123 | time.android.com | udp |
| US | 51.81.186.22:80 | 51.81.186.22 | tcp |
Files
/data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json
| MD5 | 9a60c0c1260622d9347a587b119a181e |
| SHA1 | 9614ee011972253c5a7a6080392d0224e4911ddf |
| SHA256 | e7b65381c26dc596ecb6ebe077316a50a117a73281175be2e0d3781d66ad6951 |
| SHA512 | f428766663bb6e7b20292b2ed80b6fc5194a84e994e8c41ac539669fcd9dc4db7f4c09cc899f22b5c4f02abb7caac8a37c0d58849f76c11834a37678ca7a6f53 |
/data/user/0/com.home.nurse/app_DynamicOptDex/NmDD.json
| MD5 | 9a60c0c1260622d9347a587b119a181e |
| SHA1 | 9614ee011972253c5a7a6080392d0224e4911ddf |
| SHA256 | e7b65381c26dc596ecb6ebe077316a50a117a73281175be2e0d3781d66ad6951 |
| SHA512 | f428766663bb6e7b20292b2ed80b6fc5194a84e994e8c41ac539669fcd9dc4db7f4c09cc899f22b5c4f02abb7caac8a37c0d58849f76c11834a37678ca7a6f53 |