Overview

overview

10

Static

static

Android APK

android_x86_64

10

Analysis

  • max time kernel
    43292s
  • max time network
    141s
  • platform
    android_x86_64
  • resource
    android-x86_64
  • submitted
    05-03-2021 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Correos_Seguimiento.apk

  • Size

    2.6MB

  • MD5

    b5ed569ccb0dcb73b78bd471cc5c7193

  • SHA1

    d3226720af70556411228f967228fa775b60b0e3

  • SHA256

    85e2227bac98f2a283470798f9f15d63dc3e8f5d98c71385514603f181aefd83

  • SHA512

    9b26696b75ab92429ae3e715cf0d9cdbec775ff15f6d70381a60630010029621b2119f7c080a9c7644beb55a21bcb135630bd2804e1c901673132c490805ac1b

Score
10/10
alienbotbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://drasdsasa.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Removes its main activity from the application launcher 7 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Tries to add a device administrator. 1 IoCs
  • Uses reflection 64 IoCs
    obfuscation
  • 57 IoCs

Processes

  • collect.path.one
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Tries to add a device administrator.
    • Uses reflection
    PID:3612
    • collect.path.one
      2⤵
        PID:3682
      • getprop
        2⤵
          PID:3682
        • collect.path.one
          2⤵
            PID:3768
          • getprop
            2⤵
              PID:3768
            • collect.path.one
              2⤵
                PID:3803
              • getprop
                2⤵
                  PID:3803
                • collect.path.one
                  2⤵
                    PID:3849
                  • getprop
                    2⤵
                      PID:3849
                    • collect.path.one
                      2⤵
                        PID:3899
                      • getprop
                        2⤵
                          PID:3899
                        • collect.path.one
                          2⤵
                            PID:3932
                          • getprop
                            2⤵
                              PID:3932

                          Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads