General

  • Target

    AndroidGuncelleme.apk

  • Size

    2.1MB

  • Sample

    221128-vhkffaag76

  • MD5

    7cb23390212d9a5359fc2931b414399e

  • SHA1

    f9c6b289dfd7aded65d830727944867edbbce1ad

  • SHA256

    48eb4aca391bc96a97f080f4534e6bd9abb2f29eafb3d388927009b5a102fc92

  • SHA512

    457432eacb2f48d757f40d29b5a99cd65a6e6a535dcfbaae34a853afafc87c7699451a03bf00f6a3c1b6eb5e156f443a700108f6c9f70e7ba6eb053cb29717a3

  • SSDEEP

    49152:ijkD8Qbmtu3TqG1PcgYgRspfO5KifO0wnviujng53+mmaIHYoD:ifSqGqGbYWoifOlbjnUOf

Malware Config

Extracted

Family

cerberus

C2

http://135.181.83.2

Targets

    • Target

      AndroidGuncelleme.apk

    • Size

      2.1MB

    • MD5

      7cb23390212d9a5359fc2931b414399e

    • SHA1

      f9c6b289dfd7aded65d830727944867edbbce1ad

    • SHA256

      48eb4aca391bc96a97f080f4534e6bd9abb2f29eafb3d388927009b5a102fc92

    • SHA512

      457432eacb2f48d757f40d29b5a99cd65a6e6a535dcfbaae34a853afafc87c7699451a03bf00f6a3c1b6eb5e156f443a700108f6c9f70e7ba6eb053cb29717a3

    • SSDEEP

      49152:ijkD8Qbmtu3TqG1PcgYgRspfO5KifO0wnviujng53+mmaIHYoD:ifSqGqGbYWoifOlbjnUOf

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks