Analysis
-
max time kernel
3881554s -
max time network
155s -
platform
android_x86_64 -
resource
android-x86_64_arm64 -
submitted
20-11-2020 20:30
General
-
Target
pandemdest.apk
-
Size
1.9MB
-
MD5
8b219d57fafcdb3b2e0d053d344c98c8
-
SHA1
566bdae1390d8e9c910064c9f4a3812f3abc9a67
-
SHA256
87cff4f61b32306eaec1f50af02d0521937aadd6f1c1a3b3d5ea177ebe690f47
-
SHA512
53d4fb2e8b2e2269968e93cf3d5d18e3a8d3ce82f44a9f9324ad84c7103e36746099a2ca7f6d656d11e75e9253cd9fb37053afcea6c144d727353a0da208f690
Score
10/10
Malware Config
Extracted
Family
alienbot
C2
http://ricktreemonkey54st.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
-
Suspicious use of android.app.ActivityManager.getRunningServices 193 IoCs
-
Suspicious use of android.telephony.TelephonyManager.getLine1Number 2 IoCs
-
Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso 2 IoCs
-
Uses reflection 43 IoCs
Processes
-
valve.general.hour1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads name of network operator
- Suspicious use of android.app.ActivityManager.getRunningServices
- Suspicious use of android.telephony.TelephonyManager.getLine1Number
- Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso
- Uses reflection