Overview

overview

10

Static

static

Android APK

android_x86_64

10

Analysis

  • max time kernel
    1068934s
  • max time network
    140s
  • platform
    android_x86_64
  • resource
    android-x86_64
  • submitted
    08-12-2020 00:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    UpdateApps_obf.apk

  • Size

    2.7MB

  • MD5

    3d17727e871c75397625b9c235e24c35

  • SHA1

    e8d5218a592a25318ab42ad58c68a6683a1a5bc3

  • SHA256

    ef4e055b09926d762ce6beae47df5170980213d8e69d6c6a7952f0b24748814f

  • SHA512

    4528c17a9c145d4820081fae2c02f0138bdbb0b98ace08aeb4737f87ac56250a1a559a56d3f72c63e89420290abdc615d8af43028623ba346f165b1802bdc582

Score
10/10
alienbotbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://yataarfsns.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Removes its main activity from the application launcher 3 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads name of network operator 1 IoCs

    Uses Android APIs to discover system information.

  • Suspicious use of android.app.ActivityManager.getRunningServices 23 IoCs
  • Suspicious use of android.telephony.TelephonyManager.getLine1Number 6 IoCs
  • Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso 2 IoCs
  • Uses reflection 71 IoCs
    obfuscation

Processes

  • sun.excuse.image
    1⤵
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads name of network operator
    • Suspicious use of android.app.ActivityManager.getRunningServices
    • Suspicious use of android.telephony.TelephonyManager.getLine1Number
    • Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso
    • Uses reflection
    PID:3597
    • sun.excuse.image
      2⤵
        PID:3643
      • getprop
        2⤵
          PID:3643
        • sun.excuse.image
          2⤵
            PID:3730
          • getprop
            2⤵
              PID:3730

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads