Analysis

  • max time kernel
    2771733s
  • max time network
    105s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    23-11-2022 15:55

General

  • Target

    AndroidGuncelleme.apk

  • Size

    2.0MB

  • MD5

    be899159f9d9f6759f269a9dab03515f

  • SHA1

    6d408ce135076e8e3d978b4b5c28c397efb0f380

  • SHA256

    aaa21b0b50dc4e0e3be8492b4ce286965f0a864a2a69c9d853f3f89e75b35003

  • SHA512

    bac6a92a72aef8ae1068fe75a4e40eb92bb81d69a543ccb7a45a1d3869b0e73125c503027e03a2e232678688095594322c73a4a0c454545958f52985ce08e008

  • SSDEEP

    49152:6YFqm2OT/PAvKdRtSQbPO4G44nviujng53+mmaIHYMHS:6K2ODAv0RwF4GRbjnUOu

Malware Config

Extracted

Family

cerberus

C2

http://162.55.46.183

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.celery.true
    1⤵
    • Loads dropped Dex/Jar
    PID:4749

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.celery.true/app_apk/system.apk

    Filesize

    316KB

    MD5

    69b3ca57adef18f47b71ce651769abf4

    SHA1

    7204f2b55b577cadc557a4074c29831e313662d6

    SHA256

    26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

    SHA512

    22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

  • /data/data/com.celery.true/app_apk/system.apk

    Filesize

    316KB

    MD5

    69b3ca57adef18f47b71ce651769abf4

    SHA1

    7204f2b55b577cadc557a4074c29831e313662d6

    SHA256

    26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

    SHA512

    22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

  • /data/data/com.celery.true/app_apk/system.apk

    Filesize

    316KB

    MD5

    69b3ca57adef18f47b71ce651769abf4

    SHA1

    7204f2b55b577cadc557a4074c29831e313662d6

    SHA256

    26533562f7e9db5feafc571f9cea03cc80fcd2917ebb0744de30fb8dec12141b

    SHA512

    22713beed0583876a801eeef1e13a5677025567866e898fedb8201befdab3a4d88de759a410bcb00f7ba8261a10cce977328d536436989b051df6495998a31f1

  • /data/user/0/com.celery.true/app_DynamicOptDex/FfrSsYE.json

    Filesize

    54KB

    MD5

    3d8b7c104803af3c991f63f9f1121d3b

    SHA1

    6c0589b2d3b43647985045ad7ebc21d0095d7c82

    SHA256

    003e4e598feb327a97856f562e17c5733eabf54a423fa2587193e2be02c74b4f

    SHA512

    1c7d3579bc34c34496f0ac0f968c9deae5398a619acc71fb08e7fc6dafef2ad7c8ff7870389c8eefce069df9ba4c9f00300d5ea74017fbc723cc9030a1eb75ee

  • /data/user/0/com.celery.true/app_DynamicOptDex/FfrSsYE.json

    Filesize

    103KB

    MD5

    f7825f1a50a9435caf286321a1f2941f

    SHA1

    5142f6a4099fb799824de4f5cd86f90429ef12d5

    SHA256

    8434b05fa1c0ae38c24f23e6f57eb9362f665985d00af1c06bbc073a11815ca7

    SHA512

    be3e72806cb99e2c96ab373c65b75597f1060b1e217b4f16b7e16c4ba9f79795331a2f3a7869e23493f9498c5411537cd4868e30a546407b0b75cc3fd565a6c9

  • /data/user/0/com.celery.true/app_DynamicOptDex/oat/FfrSsYE.json.cur.prof

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.celery.true/app_apk/system.apk

    Filesize

    346KB

    MD5

    0f0b849a407e63fbfd6ab212b89b0177

    SHA1

    a9c859da13fbf6add0f3a3ccf6a2d46ced8695d3

    SHA256

    8941c02d6dd5bc5cbff919c93a3642498e07991e6b8cd3205df9950c764dda95

    SHA512

    8ab86843acf4a685211ab3ba8079cc5b8b4f2ab2127096a8c3afe34c99358faee967cb68fd3b8c69cb09a76f2302396bb0c6ab5fba7e81ced500061ff239b99b

  • /data/user/0/com.celery.true/app_webview/.com.google.Chrome.f1faIG

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.celery.true/app_webview/Cookies

    Filesize

    64KB

    MD5

    9b23e6a88d5a95f155f205cb04b93cd0

    SHA1

    b62dccbbef087a0731f226b96d15d35d8aa5e5fc

    SHA256

    f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857

    SHA512

    bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482

  • /data/user/0/com.celery.true/app_webview/Cookies-journal

    Filesize

    1KB

    MD5

    7bc1c072627f2dbb09cdc91b5a5abaad

    SHA1

    27f5cf99d79d8d351160727513381a3674ae6876

    SHA256

    56da57f1cde1689e87cc2e119c8c3851d865e40483afb95b1b02a8223074fbb8

    SHA512

    86b61d5fa0d79fab48d01db0762534981ed76397068204ecbe5bd660e12a9b362587c845d385f61db395bdfd638c236dc69b78f0c39dff91be243e452dbf4308

  • /data/user/0/com.celery.true/app_webview/GPUCache/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.celery.true/app_webview/GPUCache/index-dir/temp-index

    Filesize

    96B

    MD5

    c64c5e569ae09965751df34026cdb62a

    SHA1

    3474008c0d1a0417c69db3b4e4c416f99bd4146e

    SHA256

    3d73f364c42b716d6396a7b92b9f99f458f99f43cf26a850b983cbc50856c6c7

    SHA512

    3df64b7c87acfe023795554b37d8cfa35b5c093a92e682bbdbe87b7f9f080a3f02f26e295a9a9a895017387334419efe23455cdef23804e5a9328317da25585d

  • /data/user/0/com.celery.true/app_webview/Web Data

    Filesize

    112KB

    MD5

    b663831f8cc130493476d94f2d7a5330

    SHA1

    043a1956ab8e40821d67043f8a9110a8eb36fb93

    SHA256

    c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

    SHA512

    e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

  • /data/user/0/com.celery.true/app_webview/Web Data-journal

    Filesize

    1KB

    MD5

    530453ab2953a44881c9c8aec584df79

    SHA1

    26cd3d4b7a031d93046eed3b013f25a7291ab4ff

    SHA256

    d27e0df3d4f9ba5c003bba9bf8a5b3ac4b69c105025c667204cf63dea3cb5983

    SHA512

    1de9c7d64be7fb563abd7eb179c3f3860c35461baffbe89e32b2d6e1d025e792de09846de5e4abf6f2a740e5f96a18d24471d15f0fc7465eab03cd4fd6ea789d

  • /data/user/0/com.celery.true/app_webview/metrics_guid

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.celery.true/app_webview/metrics_guid

    Filesize

    36B

    MD5

    51a125bb1e43aeaa0425adf1308f4c53

    SHA1

    17c492a233f7937857073d14f91c9a904dc8b324

    SHA256

    37c30d3d7087566f1224b77e74977db637f26ef880165b227158c9e7a9d508ce

    SHA512

    fc06ad886138ad257497443a1960d021013e96ed15a7d2743bbd5686a7e965fa5fd6c8ece55b80796ab2538d753217301c4c63b142119565cac97e196bb99944

  • /data/user/0/com.celery.true/app_webview/variations_seed_new

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.celery.true/app_webview/variations_stamp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.celery.true/app_webview/webview_data.lock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.celery.true/cache/WebView/Crashpad/settings.dat

    Filesize

    40B

    MD5

    7d8cdfdb3aa14035335546b42e023ad9

    SHA1

    2c7cc835a603483ef9bc8e83db9e7f84aa18d664

    SHA256

    d7c6743141ddde746ea5adeb04837025dce7b59da9c9f6da4461e209fee09074

    SHA512

    af31eadec3a2c579e17b2f7291b99ba66d28d162877d4107867f15a2eba71ac949e8f54163c0d54eb4b156b9bd5234290de27cd6e134af218aef2f5f6b304733

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/08a676c78d1b5fe8_0

    Filesize

    29KB

    MD5

    39ad54ccd1617fb2574a6b8e7388e0dd

    SHA1

    8feb23f0f5ceff7e37d5c858895d4f8652df09db

    SHA256

    befa37c02b235d72aa2df17f54c8c0c24e87d53b32383c18e3c38b5432703af5

    SHA512

    40da726bafd0ed40ede83648fa0a8283587316eb0082786ff481178435c8d6e530feca5cdf13712b22e08a738aabba66454456a22f9bbf559b490b8c7d718d4f

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/180574ed5181a14b_0

    Filesize

    38KB

    MD5

    3aa798d73fcb903ae311c85ef0645211

    SHA1

    11176b0bc071e1ba8f6a9552d70c618f35e252ca

    SHA256

    bc92a347bb5d9f3c6a3b53b778d7b779b20b5f69db398b564a6592dfab98b8f0

    SHA512

    ae1835c0caf8e4423886877995f151036cfdc6cd7d97d63d7e18bf06e3d48a911efec730136e734f28d748d436a51cff556906cf43d5f4e32a4c82239d6f80cd

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/Code Cache/js/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

    Filesize

    96B

    MD5

    f479da58b81dd62472f25188ff788f60

    SHA1

    23414597b47ba786eb0b2aa44a0c0730c2a1f095

    SHA256

    e9b1a8f36f703335cfc87f7b0efbb8223d338bd72009ea55ad0ad43184bc2ec2

    SHA512

    17162e511ddce0e399cad37f6ebc38a430789bc1af9a1aaf9072899b5d25b84de9c2b78ca9230c22fec18f114a8d2d1445c081361d7f68608e6ac769646b8679

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    96B

    MD5

    cc988a0d4ecd0e0efe9396b664eedd0f

    SHA1

    f4c2467cca1f81db42f57bc319ced443cf0466d8

    SHA256

    a55c111c8678acda6dcfc7421f327df6fe30d34b01a43bcc570bb1cd3ad5ee6b

    SHA512

    bcec23ff295e5dde9c736e992e1123b1b91c109dd9ee79e414e2223919ec01240c5e83f3ffb93259b265716903a749312808117134af0a4ef6bdce19fa31fb3e

  • /data/user/0/com.celery.true/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    192B

    MD5

    b66beb569fa7d55d49acd3f1bb42c1dd

    SHA1

    523f9a710dfd2a0839dc913f63c8d3e9d7c6753d

    SHA256

    3f2e2b67bd3952e4a80634cabe1a7d9d20a3c9ae3c37cc3290690d95ac64fb43

    SHA512

    cd669ec146b0a8677649ca3be954ef5695a62c4428be0de44c317f4ae683aba05318afdae6244a61fbf2f7c83074213ebc4a71b132921675e328fd51dacc5c8d

  • /data/user/0/com.celery.true/shared_prefs/WebViewChromiumPrefs.xml

    Filesize

    127B

    MD5

    6ef709b8536878951e87c29a1518fc2b

    SHA1

    24376c70b00152501b3d98df61fa7db435339172

    SHA256

    10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

    SHA512

    96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

  • /data/user/0/com.celery.true/shared_prefs/settings.xml

    Filesize

    116B

    MD5

    d238bcaede8d9fc88b09c0e7fa6248f3

    SHA1

    7dc3c46230aeff7499e958a777a15ba65d483933

    SHA256

    44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1

    SHA512

    ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52

  • /data/user/0/com.celery.true/shared_prefs/settings.xml

    Filesize

    163B

    MD5

    95f6cf275d56aef2102b62828f7034c0

    SHA1

    8117a0e4daf60ee6edf88e6992c764680be59890

    SHA256

    5dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96

    SHA512

    6dd12b3f5091eea21604e412748d14e48f77ce03982768cfad754bd581a024b6ccb3e99ed094b4ac27493ac225c99504f6d55b215db2e9e11f1df234d86925fe