Overview

overview

10

Static

static

7

2B43AF4639...23.apk

android_x86

10

2B43AF4639...23.apk

android_x64

10

2B43AF4639...23.apk

android_x64

Analysis

  • max time kernel
    605084s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    02/06/2022, 10:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2B43AF46398ECE7B9E1E41BB7C2E2FF3EC227EDB38283BEA7622115BB76A7823.apk
  • Size 160KB
  • Sample220602-mq9rasafem
  • SHA256 2b43af46398ece7b9e1e41bb7c2e2ff3ec227edb38283bea7622115bb76a7823
  • MD5 SHA1 SHA512
Score
10/10
cerberusbankerevasioninfostealerrattrojan

Malware Config

Extracted

Family

  • cerberus

C2

  • http://lanadelrey.top

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
    evasion

Processes

  • com.ytnfrar.rtom
    1⤵
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:6278

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        index
        • Path /data/user/0/com.ytnfrar.rtom/app_webview/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.ytnfrar.rtom/app_webview/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 77145e3e9e0702c9d34f6722dea461325b4fa5077c268a7fd1adaecefc200bf3
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.ytnfrar.rtom/app_webview/Web Data
        • Size 112KB
        • SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.ytnfrar.rtom/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 fb4dbe06cadba80f29efde2f7c2c1aa09c4700757e126ed39d00fdf3be82b5e6
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.ytnfrar.rtom/app_webview/metrics_guid
        • Size 36B
        • SHA256 40f8414c526fc8a221afb0254617f919beab2af7f73a3c67e4bdf679d44fec6b
        • MD5 SHA1 SHA512
        Submit Download

        settings.dat
        • Path /data/user/0/com.ytnfrar.rtom/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 8f0d2126dcdce3d4615e9059e9bd9da76bfe87887bd17b3b9926b8c164952aa2
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.ytnfrar.rtom/cache/org.chromium.android_webview/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.ytnfrar.rtom/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 4855a17c101826e89bb705db4fdea77c81d4e1b7d4ade56e153d97ee84093756
        • MD5 SHA1 SHA512
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.ytnfrar.rtom/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
        • MD5 SHA1 SHA512
        Submit Download