1/ This morning I was reading this article about a new android banking trojan: business.xunison.com/thiefbot-a-new…
I noticed the C2C was still alive, so I decided to look at it
I noticed the C2C was still alive, so I decided to look at it
2/ I wanted to see if I can find info on the cybercriminal behind this website.
I enumerated the possible folders (my list is crappy) and found these folders
I enumerated the possible folders (my list is crappy) and found these folders
3/ I tried wp-admin and I got the following source code
4/ The string "beget=begetok" catched my attention. If you search it on Google you find this reddit post, probably not made by our guy. reddit.com/r/perl/comment…
5/ On this stackoverflow question, the code is similar to our page stackoverflow.com/questions/4375…
6/ I don't have time to dig more but feel free to do it and post the updates here! I will continue later.
- On the original article, they managed to access to the dashboard
- The APK has probably something to tell 7bf12ce87f1be65f14289fe4f9a7fe4c79b145ec8dd8b1d88ce3faf9036b1836
- On the original article, they managed to access to the dashboard
- The APK has probably something to tell 7bf12ce87f1be65f14289fe4f9a7fe4c79b145ec8dd8b1d88ce3faf9036b1836
7/ Watch your mouth kiddo!
8/ The APK is just a dropper. The nasty stuff are in this inj zip file
9/ All the requests return 404, the backend is not working anymore.
10/ On the original thread the guy mentionned his telegram account. If you search it on Youtube you find this video
11/ He advertised that as Cerberus2. The source code of Cerberus has been leaked few days ago.
12/ Nice follow-up by @f3d__
13/ The C2C is now down
