General

  • Target

    cdaf1fde179847a76703dbb3037f8bfc99d74ccc692b803dd7db638c672c85be.apk

  • Size

    116KB

  • Sample

    220911-vpdw8sffgr

  • MD5

    0a9a432447e772c33a9f50257933a80e

  • SHA1

    b935efec05abb5a8be56f3494af973233113f773

  • SHA256

    cdaf1fde179847a76703dbb3037f8bfc99d74ccc692b803dd7db638c672c85be

  • SHA512

    f175888ef37dc034e909c527df4deac4a624219df9265573b8071b51d9b64044472e54a659b4376b06c1721a91888316a76bcf12ea16577a1220e398a6352fc2

  • SSDEEP

    3072:LsrgmNZpfmYhWc1pUxU/V6VwH3m7Fm7O0W:LsjNZYYhF1O2/EeH3mpmq0W

Malware Config

Extracted

Family

cerberus

C2

http://kahramanspor.ml

Targets

    • Target

      cdaf1fde179847a76703dbb3037f8bfc99d74ccc692b803dd7db638c672c85be.apk

    • Size

      116KB

    • MD5

      0a9a432447e772c33a9f50257933a80e

    • SHA1

      b935efec05abb5a8be56f3494af973233113f773

    • SHA256

      cdaf1fde179847a76703dbb3037f8bfc99d74ccc692b803dd7db638c672c85be

    • SHA512

      f175888ef37dc034e909c527df4deac4a624219df9265573b8071b51d9b64044472e54a659b4376b06c1721a91888316a76bcf12ea16577a1220e398a6352fc2

    • SSDEEP

      3072:LsrgmNZpfmYhWc1pUxU/V6VwH3m7Fm7O0W:LsjNZYYhF1O2/EeH3mpmq0W

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks