MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c81234b6ceb3572c6d862a9313e019b98efd83165d8c085bd3e74971c66763bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c81234b6ceb3572c6d862a9313e019b98efd83165d8c085bd3e74971c66763bb
SHA3-384 hash:	202531a13551879bea5396aa8b8ff922c8efaaadb3c00d5732a3ff54e2b01b46a13e0ff1cb9b5b4d3f7651df080a2a0f
SHA1 hash:	9cddff2056ccfcfbd30d3ed50651a45c69a5e840
MD5 hash:	3f3bef2f188d420c30c2616cc74c69e5
humanhash:	hot-alabama-indigo-lake
File name:	c81234b6ceb3572c6d862a9313e019b98efd83165d8c085bd3e74971c66763bb_video.apk
Download:	download sample
Signature	Cerberus Alert Create hunting rule
File size:	2'121'030 bytes
First seen:	2022-12-15 11:09:47 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:ywkDVrfNOesuX/0KjKooHMzWwyuyjrlUy7HOWwU6:ywkDxfgesuX/0KjKoaM6v7jey7vw1
TLSH	T1DBA533CF0A905A60D8932E3146660643D7BB5359430BAA8F302F02569FB3FD55F698FE
TrID	49.3% (.APK) Android Package (38500/1/9) 17.9% (.ZIP) Opera Widget (14000/1/2) 17.3% (.JAR) Java Archive (13500/1/2) 8.9% (.MAFF) Mozilla Archive Format (gen) (7000/1/1) 5.1% (.ZIP) ZIP compressed archive (4000/1)
Reporter	AykutBasi
Tags:	apk Cerberus signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

494

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_24.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/639b008c7459fa681d0d67f8/reports/23d65ba3-bc1d-4dd7-ba81-612ae43c9c56/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/3f3bef2f188d420c30c2616cc74c69e5/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

send SMS messages (SEND_SMS)

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

directly call phone numbers (CALL_PHONE)

record audio (RECORD_AUDIO)

retrieve running applications (GET_TASKS)

list accounts (GET_ACCOUNTS)

read phone state and identity (READ_PHONE_STATE)

allow application to recognize physical activity (ACTIVITY_RECOGNITION)

read contact data (READ_CONTACTS)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read SMS or MMS (READ_SMS)

receive SMS (RECEIVE_SMS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

access extra location provider commands (ACCESS_LOCATION_EXTRA_COMMANDS)

measure application storage space (GET_PACKAGE_SIZE)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

allow use of fingerprint (USE_FINGERPRINT)

view Wi-Fi status (ACCESS_WIFI_STATE)

view network status (ACCESS_NETWORK_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

create Bluetooth connections (BLUETOOTH)

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/c81234b6ceb3572c6d862a9313e019b98efd83165d8c085bd3e74971c66763bb

Joe Sandbox Cerberus

Result

Threat name:

Cerberus

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1134942

Signature

Access the class loader (often done to load a new code)

Accesses FileOutputStream via Reflection

Antivirus / Scanner detection for submitted sample

Deletes other packages

Detected Cerberus Banking Trojan

Drops a new APK file

Loads new DEX files via dynamic constructor

Multi AV Scanner detection for submitted file

Removes its application launcher (likely to stay hidden)

Requests to ignore battery optimizations

Starts/registers a service/receiver on screen off

Tries to disable the administrator user

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c81234b6ceb3572c6d862a9313e019b98efd83165d8c085bd3e74971c66763bb/

ReversingLabs TitaniumCloud Android.Dropper.Hqwar

Threat name:

Android.Dropper.Hqwar

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-12-12 15:51:33 UTC

File Type:

Binary (Archive)

Extracted files:

148

AV detection:

9 of 24 (37.50%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zajdjnwownlsy3mgfkjrhyazxghp3aywlwgaqw6t45exdrthmo5q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

android evasion

Link:

https://tria.ge/reports/221215-m9pkgacc25/

Behaviour

Removes a system notification.

Acquires the wake lock.

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c81234b6ceb3572c6d862a9313e019b98efd83165d8c085bd3e74971c66763bb