Resubmissions

04-01-2022 14:45

220104-r421tshedl 10

04-01-2022 14:39

220104-r1jebaahhl 7

04-01-2022 12:22

220104-pjxjhagba3 7

04-01-2022 12:20

220104-phrxmagba2 7

General

  • Target

    Hadise_Ifsa_build_obf.apk

  • Size

    1.9MB

  • Sample

    220104-r421tshedl

  • MD5

    f2b673c2abb56cb6e27164458ebd550b

  • SHA1

    8e7df51c99929c8a3d0cece6d1ee081ae24a69f1

  • SHA256

    4a6509d3e24da811dbb106243bc3654e5edf7d2c1232febcc07739d513927b2d

  • SHA512

    4fc136c010537bc8ba758412f3d96573a5bb5a953e0a081263eeeae747c0a59a72e9582614b4d758428de4072a7dfa6597abacfcec00639f266388350b7cfe2a

Malware Config

Extracted

Family

cerberus

C2

http://51.81.86.211

Targets

    • Target

      Hadise_Ifsa_build_obf.apk

    • Size

      1.9MB

    • MD5

      f2b673c2abb56cb6e27164458ebd550b

    • SHA1

      8e7df51c99929c8a3d0cece6d1ee081ae24a69f1

    • SHA256

      4a6509d3e24da811dbb106243bc3654e5edf7d2c1232febcc07739d513927b2d

    • SHA512

      4fc136c010537bc8ba758412f3d96573a5bb5a953e0a081263eeeae747c0a59a72e9582614b4d758428de4072a7dfa6597abacfcec00639f266388350b7cfe2a

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks