General

  • Target

    AndroidGuncelleme.apk

  • Size

    2.0MB

  • Sample

    221123-tcsdesdf86

  • MD5

    be899159f9d9f6759f269a9dab03515f

  • SHA1

    6d408ce135076e8e3d978b4b5c28c397efb0f380

  • SHA256

    aaa21b0b50dc4e0e3be8492b4ce286965f0a864a2a69c9d853f3f89e75b35003

  • SHA512

    bac6a92a72aef8ae1068fe75a4e40eb92bb81d69a543ccb7a45a1d3869b0e73125c503027e03a2e232678688095594322c73a4a0c454545958f52985ce08e008

  • SSDEEP

    49152:6YFqm2OT/PAvKdRtSQbPO4G44nviujng53+mmaIHYMHS:6K2ODAv0RwF4GRbjnUOu

Malware Config

Extracted

Family

cerberus

C2

http://162.55.46.183

Targets

    • Target

      AndroidGuncelleme.apk

    • Size

      2.0MB

    • MD5

      be899159f9d9f6759f269a9dab03515f

    • SHA1

      6d408ce135076e8e3d978b4b5c28c397efb0f380

    • SHA256

      aaa21b0b50dc4e0e3be8492b4ce286965f0a864a2a69c9d853f3f89e75b35003

    • SHA512

      bac6a92a72aef8ae1068fe75a4e40eb92bb81d69a543ccb7a45a1d3869b0e73125c503027e03a2e232678688095594322c73a4a0c454545958f52985ce08e008

    • SSDEEP

      49152:6YFqm2OT/PAvKdRtSQbPO4G44nviujng53+mmaIHYMHS:6K2ODAv0RwF4GRbjnUOu

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks