Analysis
-
max time kernel
1489194s -
max time network
155s -
platform
android_x86_64 -
resource
android-x86_64_arm64 -
submitted
12-12-2020 21:00
General
-
Target
Evdeyim.apk
-
Size
2.3MB
-
MD5
3bfd4d18a3ceb4fb378772f1e4d1540c
-
SHA1
5f9926d498c3cd78fd99244cdd9f92de3a0eebc1
-
SHA256
bce447711725ad9106a0094d25220103b1bf4ba83bc247b3662ff4a6bfe9c67e
-
SHA512
dd841f39db5569e6ab1090eb0633f1370911edea38debc6621b57287d09063450c23a3b3f33b4e93269cda72a5c984537c03219a82cde834b202e5249c333f5a
Score
10/10
Malware Config
Extracted
Family
alienbot
C2
http://asf12552fg.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 12 IoCs
Runs executable file dropped to the device during analysis.
-
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
-
Suspicious use of android.app.ActivityManager.getRunningServices 201 IoCs
-
Suspicious use of android.telephony.TelephonyManager.getLine1Number 2 IoCs
-
Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso 2 IoCs
-
Uses reflection 53 IoCs
Processes
-
ghost.bottom.gap1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads name of network operator
- Suspicious use of android.app.ActivityManager.getRunningServices
- Suspicious use of android.telephony.TelephonyManager.getLine1Number
- Suspicious use of android.telephony.TelephonyManager.getNetworkCountryIso
- Uses reflection