Analysis

  • max time kernel
    1362393s
  • max time network
    86s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    07/11/2022, 08:26

General

  • Target
    daeee957a71220290b16e67d7795f9c0.apk
  • Size 1.9MB
  • Sample221107-kbzxfaacdm
  • SHA256 89f35e028e15b82fd3cf4bb1588383de792579e389596d6c0800bf2f045ed4e2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cerberus

C2
  • https://heryerdesenvarsinbebatin.xyz

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.iclejsxai.tbxgobvgw
    1⤵
    • Loads dropped Dex/Jar
    PID:4774

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.apk.pykytfg1.6jd

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/8Tyt68g9g7/yeiHHTgaye8jHgg/base.apk.pykytfg1.6jd
        • Size 198KB
        • SHA256 e99d587969b680624c4de1404ba3f92b4d975bbfcff83f968c83578471040325
        • MD5 SHA1 SHA512 SSDEEP

        system.apk

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_apk/system.apk
        • Size 346KB
        • SHA256 77fc15b3888378699fd43b4cbc1745461d6507aaa2e203ec0dad9de51dc110f7
        • MD5 SHA1 SHA512 SSDEEP

        Cookies

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/Cookies
        • Size 64KB
        • SHA256 f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857
        • MD5 SHA1 SHA512 SSDEEP

        Cookies-journal

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/Cookies-journal
        • Size 1KB
        • SHA256 4dd69a0baafa4e33849aff7a6e951837117b2169114f86498f145b98ae1ef94f
        • MD5 SHA1 SHA512

        index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 de4eb7aab52ef7feb8ad7c517a4ebe5d59d75186027ef49e67225e806836113b
        • MD5 SHA1 SHA512

        Web Data

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/Web Data
        • Size 112KB
        • SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
        • MD5 SHA1 SHA512 SSDEEP

        Web Data-journal

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 6ca20eceb7ba35dfe6e74448c3f61e10754dca425c4707601608e216fcf3363c
        • MD5 SHA1 SHA512

        metrics_guid

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/app_webview/metrics_guid
        • Size 36B
        • SHA256 1055c132bc52da7cad7c0cdc044722cb57b25d8053bb417cabf34342241c98b6
        • MD5 SHA1 SHA512

        settings.dat

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 2f4145ef58acf611beffe850770027389c7a568eb21a37e9070204468e92aad9
        • MD5 SHA1 SHA512

        949b862d42a065f1_0

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/949b862d42a065f1_0
        • Size 11KB
        • SHA256 98060f1b797b6a1a85982493a273edb079c1a11aaf18f11b5c66562c1d0743aa
        • MD5 SHA1 SHA512 SSDEEP

        9d4c559e17a87186_0

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/9d4c559e17a87186_0
        • Size 11KB
        • SHA256 d837624eba3838c30473d81f8953b3f3ba1eeb28a5b99781047e142df5bceca6
        • MD5 SHA1 SHA512 SSDEEP

        index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 1193d8def2d8678e3e0849716c239e266de6f5cac658edcf034510d4c3b612f7
        • MD5 SHA1 SHA512

        d1b1ac9f21bb8e08_0

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/d1b1ac9f21bb8e08_0
        • Size 500KB
        • SHA256 ef240d2086c878d0f01dcf25f2b11700bd55b3c894d6df78a6587e0a072a732c
        • MD5 SHA1 SHA512 SSDEEP

        f7d03f364b9296f3_0

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/f7d03f364b9296f3_0
        • Size 58KB
        • SHA256 af3d01e634b2ab07ef930e86f1a9a3f7b94fb874fa0811e73bb93d58f72de9ac
        • MD5 SHA1 SHA512 SSDEEP

        index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 96B
        • SHA256 d2140a44710690d725caaa8e033a8d8ae865bcdfad8e4928dd01417740da3022
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 288B
        • SHA256 a1a8c77c5c1b8b753378962f3f3d06530b392a175f5e816b821b6127a6b5532f
        • MD5 SHA1 SHA512

        WebViewChromiumPrefs.xml

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
        • MD5 SHA1 SHA512

        multidex.version.xml

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/shared_prefs/multidex.version.xml
        • Size 307B
        • SHA256 185b50df9076343649a5f4d9de2d84f00b19230322de9121dd02e56ec5297ab5
        • MD5 SHA1 SHA512

        settings.xml

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/shared_prefs/settings.xml
        • Size 116B
        • SHA256 44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1
        • MD5 SHA1 SHA512

        settings.xml

        • Path /data/user/0/com.iclejsxai.tbxgobvgw/shared_prefs/settings.xml
        • Size 163B
        • SHA256 5dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96
        • MD5 SHA1 SHA512