General

  • Target

    PlayStore.apk

  • Size

    172KB

  • Sample

    221123-s8vyragd6z

  • MD5

    a16a55154e6f256ffbe1c3722ce961f4

  • SHA1

    24b916d1c5f6fb9c454219643202cdf1c69fa4f2

  • SHA256

    92d7d0bba57924be20718710f070f56d133a0ff5fdfdf20c23f099b908b1f34c

  • SHA512

    6d394e1f3e9a82ade2bc5ae977eb3f15df3f501ee5e9d2760cdf936ab2e854763186635b47e6657a3d2eecfb46faa510c7f9a0c859c4b2034bdf2905205efcbb

  • SSDEEP

    3072:yGPdU4khznxZWM+DQ8If7iWp3WpvTZKmTZKHa4EkF5a4EkFhFdNNiQahfbOFdNNf:yDlnxZWM+DQppGpgFH1Ee1Ezxvx80A

Malware Config

Extracted

Family

cerberus

C2

http://65.21.108.94/

Targets

    • Target

      PlayStore.apk

    • Size

      172KB

    • MD5

      a16a55154e6f256ffbe1c3722ce961f4

    • SHA1

      24b916d1c5f6fb9c454219643202cdf1c69fa4f2

    • SHA256

      92d7d0bba57924be20718710f070f56d133a0ff5fdfdf20c23f099b908b1f34c

    • SHA512

      6d394e1f3e9a82ade2bc5ae977eb3f15df3f501ee5e9d2760cdf936ab2e854763186635b47e6657a3d2eecfb46faa510c7f9a0c859c4b2034bdf2905205efcbb

    • SSDEEP

      3072:yGPdU4khznxZWM+DQ8If7iWp3WpvTZKmTZKHa4EkF5a4EkFhFdNNiQahfbOFdNNf:yDlnxZWM+DQppGpgFH1Ee1Ezxvx80A

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks