Resubmissions

04/01/2022, 14:45

220104-r421tshedl10

04/01/2022, 14:39

220104-r1jebaahhl7

04/01/2022, 12:22

220104-pjxjhagba37

04/01/2022, 12:20

220104-phrxmagba27

General

  • Target
    Hadise_Ifsa_build_obf.apk
  • Size 1.9MB
  • Sample220104-r421tshedl
  • SHA256 4a6509d3e24da811dbb106243bc3654e5edf7d2c1232febcc07739d513927b2d
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • cerberus

C2
  • http://51.81.86.211

Targets

    • Target
      Hadise_Ifsa_build_obf.apk
    • Size 1.9MB
    • SHA256 4a6509d3e24da811dbb106243bc3654e5edf7d2c1232febcc07739d513927b2d
    • MD5 SHA1 SHA512
    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks