cerberus | 77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55

General

Target
77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55
Size 373KB
Sample250816-ancybssxhx
SHA256 77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55
MD5 59c64251c8fe18be645070a2efedc5e8
SHA1 77a9f61f16d5befbbc1d8c9e70bff621cd18ed98
SHA512 a7498920bd226d2aeaacf5af64f0c9770f0c202b0df4f37227e758bc548e8f9c1b036d17b176b39569566f69c88297be929583cc31ac8086795aeef3faf8b7dc
SSDEEP 6144:qVdgXvzSKDTrlnwUW627eMC8F9iZK3ZBu9ZjUDWP02oQ8KRUtDutBaBjBjfpIbwg:qV+ffPlnwf6rFKJ49Zj2VQbahua5MbUU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cerberus alienbot

Malware Config

Extracted

Family

alienbot

C2

http://zenyatirim.org/

rc4.plain

Signatures

Alienbot family
alienbot
Cerberus family
cerberus

Cerberus payload 1 IoCs

resource	yara_rule
sample	family_cerberus

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to record audio.	android.permission.RECORD_AUDIO

File Explorer

77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55

.apk 373KB

77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55

SHA256 77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55
MD5 59c64251c8fe18be645070a2efedc5e8
SHA1 77a9f61f16d5befbbc1d8c9e70bff621cd18ed98
SHA512 a7498920bd226d2aeaacf5af64f0c9770f0c202b0df4f37227e758bc548e8f9c1b036d17b176b39569566f69c88297be929583cc31ac8086795aeef3faf8b7dc
SSDEEP 6144:qVdgXvzSKDTrlnwUW627eMC8F9iZK3ZBu9ZjUDWP02oQ8KRUtDutBaBjBjfpIbwg:qV+ffPlnwf6rFKJ49Zj2VQbahua5MbUU
MD5 SHA1 SHA512 SSDEEP

android

Cerberus payload

com.mhiauaqmlacl.ypmsfwbkjhsbeoz

Android Permissions

77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55

Permissions

android.permission.USE_FULL_SCREEN_INTENT

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.CALL_PHONE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.REQUEST_DELETE_PACKAGES

android.permission.SEND_SMS

android.permission.READ_CONTACTS

android.permission.WAKE_LOCK

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.GET_ACCOUNTS

android.permission.RECORD_AUDIO

77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55

com.google.android.gms.common.api.GoogleApiActivity

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.lszijh

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.nfsznithxfoc

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.pzlioudkrvprrkbf

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.edxqppjkyu

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.gwsbwjljwqx

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.gtzkggpuaqjntiao

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.dhadsej

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.lwmcrlixkvo

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.gbhqclb

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.xjcpqhzmru

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.fbicvrabe

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.cubaihhb

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.izyiyumk

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.plerbq

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.rcx

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.koulsadfaa

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.mzwfknzwgaomhign

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.hattohfg

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.bubnjkalusgi

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.vakurcpyiawjef

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.bxoyira

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.dbilktvrq

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.jwozx

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.ojfiq

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.oujqpacsiievewux

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.fnz

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.lywl

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55

com.google.android.gms.common.api.GoogleApiActivity

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.lszijh

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.nfsznithxfoc

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.pzlioudkrvprrkbf

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.edxqppjkyu

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.gwsbwjljwqx

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.gtzkggpuaqjntiao

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.dhadsej

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.lwmcrlixkvo

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.gbhqclb

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.xjcpqhzmru

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.fbicvrabe

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.cubaihhb

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.izyiyumk

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.plerbq

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.rcx

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.koulsadfaa

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.mzwfknzwgaomhign

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.hattohfg

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.bubnjkalusgi

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.vakurcpyiawjef

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.bxoyira

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.dbilktvrq

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.jwozx

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.ojfiq

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.oujqpacsiievewux

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.fnz

com.mhiauaqmlacl.ypmsfwbkjhsbeoz.lywl

Android Permissions

77e89eb7a8c5d7303715581b31c87599ff3e2e78920fa7c8e27f6bcbf5708d55