Overview

overview

10

Static

static

7

0f38ef194b...ed.apk

android_x86

10

0f38ef194b...ed.apk

android_x64

10

0f38ef194b...ed.apk

android_x64

10

Analysis

  • max time kernel
    4173400s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    25/05/2022, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0f38ef194bc254e0e600abadd62ec93c3e399ced52c073de661e9d8b2f5a7eed.apk
  • Size 1.6MB
  • Sample220525-be61gsheam
  • SHA256 0f38ef194bc254e0e600abadd62ec93c3e399ced52c073de661e9d8b2f5a7eed
  • MD5 SHA1 SHA512
Score
10/10
cerberusbankerevasioninfostealerrattrojan

Malware Config

Extracted

Family

  • cerberus

C2

  • http://banaparalazim.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion

Processes

  • jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo
    1⤵
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:6189

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        tsFR.json
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_DynamicOptDex/tsFR.json
        • Size 800KB
        • SHA256 2f5ca5e568fcdd12317235a2c239bef3b31314f1c9e594475867d920110be057
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tsFR.json
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_DynamicOptDex/tsFR.json
        • Size 800KB
        • SHA256 8a2f9418f5ab8827d0b7a430b8dd873663c51bcecd5ce74a5508aca7d0c9157a
        • MD5 SHA1 SHA512 SSDEEP
        Download

        tsFR.json
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_DynamicOptDex/tsFR.json
        • Size 800KB
        • SHA256 8a2f9418f5ab8827d0b7a430b8dd873663c51bcecd5ce74a5508aca7d0c9157a
        • MD5 SHA1 SHA512 SSDEEP
        Download

        index
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_webview/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_webview/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 6dc67dbd0fece131b40e913068a87b6df85d03238cab5682abe5ed96c94c7bc5
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_webview/Web Data
        • Size 112KB
        • SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 648f79709f47ad5f8a25a584e17a0196fc12d1a812eaa0c36149bee0b96e9e13
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/app_webview/metrics_guid
        • Size 36B
        • SHA256 0c3f8327333e3e133a815d20cc3f50610f3e5c436119e29a7d933cf48dc251c0
        • MD5 SHA1 SHA512
        Submit Download

        settings.dat
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 b02d11b3ab057198da83cd452adbb22ffcade2f15441c964e337efc735adc11e
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/cache/org.chromium.android_webview/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 728e313658f2adbb35cf37e360fe29ce5b44d4cca2693cc12851ecdf5678c1c9
        • MD5 SHA1 SHA512
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/jzctonydurqo.pyckeaigawqy.hkmnydooqkehclo/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
        • MD5 SHA1 SHA512
        Submit Download