Resubmissions

22/09/2023, 17:08

230922-vnkcmahd2z 10

21/09/2023, 18:44

230921-xdsblaca32 10

20/09/2023, 22:01

230920-1w89lsah3x 10

General

  • Target

    21440d7a9289ef45f7438109a5e334b09d917d28c4ef972d1dcae349b6e31834.bin

  • Size

    2.4MB

  • Sample

    230922-vnkcmahd2z

  • MD5

    f31c96e95584c7073b8be905e444044c

  • SHA1

    85897eb018caa5e6bd9e3419e2a36276e2d92741

  • SHA256

    21440d7a9289ef45f7438109a5e334b09d917d28c4ef972d1dcae349b6e31834

  • SHA512

    fd79918d0fd3ebfbc2ca54f1d762fa7cc952c1e052a320467f2f8f19ce03023bd3a630b78371d633f1d7fde0a2f2e1e458f3934d9c63a1c6c4dd9ac4db56a7d3

  • SSDEEP

    49152:Tavum9a2D6tudueh4w9vcZTuujopJLEE3aUbUDuoEp1vDGbXZT1RmjF0hiGb:2mv2D6tudus4dZTuujo3X3Guo6bcXZz9

Malware Config

Extracted

Family

cerberus

C2

http://94.131.11.56/

Targets

    • Target

      21440d7a9289ef45f7438109a5e334b09d917d28c4ef972d1dcae349b6e31834.bin

    • Size

      2.4MB

    • MD5

      f31c96e95584c7073b8be905e444044c

    • SHA1

      85897eb018caa5e6bd9e3419e2a36276e2d92741

    • SHA256

      21440d7a9289ef45f7438109a5e334b09d917d28c4ef972d1dcae349b6e31834

    • SHA512

      fd79918d0fd3ebfbc2ca54f1d762fa7cc952c1e052a320467f2f8f19ce03023bd3a630b78371d633f1d7fde0a2f2e1e458f3934d9c63a1c6c4dd9ac4db56a7d3

    • SSDEEP

      49152:Tavum9a2D6tudueh4w9vcZTuujopJLEE3aUbUDuoEp1vDGbXZT1RmjF0hiGb:2mv2D6tudus4dZTuujo3X3Guo6bcXZz9

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Makes use of the framework's Accessibility service.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

    • Target

      content.html

    • Size

      347B

    • MD5

      74fd9f84c290bf48987e714aa6033374

    • SHA1

      b3ae2838fc2d4389220cba8ed5caa0af350bafba

    • SHA256

      0010a2d42bd3a562aa97660c5649b0f42cf68b1e3e9937d6fc17e8a35165cde3

    • SHA512

      133935bdbd6c60af77d11443648caa8c903c7f59f64eedb1daf89cfd5d112ea7f673b6a495b0357eb32ccbc44c1005d4cc3da3d9cb44077fcb57c378f9ad0b15

    Score
    1/10
    • Target

      group_topic.html

    • Size

      321B

    • MD5

      ed703a9bc4b36a2238ef6eb1a9b5df0b

    • SHA1

      da66005dbe41721531a25c4d07ff7c4a19ba4ce3

    • SHA256

      6a6586b00ac18398a9f62611fa30c8293840f5c2ba5d1210770b914f97445705

    • SHA512

      5fb89589d08f92a638b313d7d27b3812f0351bfba98d1c4c38c2c20027406c08d6e5c19884bdf4e458c7feeac22037a39948b65c3a69d4eefd9cdf0bc7b783db

    Score
    1/10
    • Target

      mama.js

    • Size

      3KB

    • MD5

      0192d2f11a3e4e976e4290fef09980b2

    • SHA1

      3e392edec5e28c95356d504297563f22adb173da

    • SHA256

      5f186549645d7845f8aec83e532ddc69175c2532daad2ebd741b18f915ab0ee2

    • SHA512

      2d8b5f2986259d8d33c26bf11bb8cb5ce4bc069ab1620ff6f753c3c72d10c00d164c6d9d4888e6c173a7e24ada24b59b0f6d73ba695c6e9f3b5b1d31daa34a90

    Score
    1/10
    • Target

      omsdk-v1.js

    • Size

      38KB

    • MD5

      a82ff78f7ce70d5da28b9b69d7f9127b

    • SHA1

      d68639ddad3b8a9b08f8bda10ecefd9dafb89974

    • SHA256

      972e5dfea3aa699de6ad08636f575bc8b39245382c927a767b0bfac1852f6be2

    • SHA512

      755370f2df79d65150c0b8c0957e07756fcff943f8a75282d2afd6748f3928c91c91569ccb1004e38bf4fd15bc3e3f5a451fb7142189e3e9c11a27187bd8ec1e

    • SSDEEP

      768:X6kymXj28LPXwfBKn3ySNLTcC/XxUsExU58JVzdkmkWqa6W1s+Z7iUVtP9hzCsur:X6kPXqHs3b3ExU58JVzdkmkWqa6W++Zu

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks