Analysis
-
max time kernel
1189022s -
max time network
150s -
platform
android_x86_64 -
resource
android-x86_64 -
submitted
18-03-2021 19:35
Static task
static1
Behavioral task
behavioral1
Sample
Chrome3.18.2.apk
Resource
android-x86_64
android_x86_64
0 signatures
0 seconds
General
-
Target
Chrome3.18.2.apk
-
Size
3.0MB
-
MD5
061c838dffa17d136956b4eb9815d54c
-
SHA1
ee5af102c65e5da10a7b8fccd21423f3d29d1d44
-
SHA256
24893879c3a9e87ac259bc6557a0ed223bcf1abb7690ccd2edb6422f525da4a5
-
SHA512
b871d22e2c86b28b78906807750d3dca9561997df45a84818e153d152e0907993c3e8a8fa3c99142181a98bddb5f0d7881018a83c031c3fa928111744199056c
Malware Config
Extracted
Family
alienbot
C2
http://fiollool.ga
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Processes:
truck.stable.alreadypid process 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
truck.stable.alreadyioc pid process /data/user/0/truck.stable.already/app_DynamicOptDex/RWElieZ.json 3623 truck.stable.already /data/user/0/truck.stable.already/app_DynamicOptDex/RWElieZ.json 3623 truck.stable.already -
Uses reflection 64 IoCs
Processes:
truck.stable.alreadydescription pid process Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method android.content.res.AssetManager.addAssetPath 3623 truck.stable.already Invokes method android.app.ContextImpl.getAssets 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method android.content.res.AssetManager.open 3623 truck.stable.already Invokes method java.io.FilterInputStream.read 3623 truck.stable.already Invokes method java.io.FilterInputStream.read 3623 truck.stable.already Invokes method java.io.BufferedInputStream.read 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method java.io.BufferedInputStream.close 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method java.lang.String.getBytes 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method java.io.FileOutputStream.write 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method java.io.BufferedInputStream.close 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method java.io.FilterOutputStream.close 3623 truck.stable.already Invokes method android.app.ActivityThread.currentActivityThread 3623 truck.stable.already Acesses field android.app.ActivityThread.mPackages 3623 truck.stable.already Invokes method java.lang.reflect.Field.get 3623 truck.stable.already Invokes method java.lang.Object.getClass 3623 truck.stable.already Invokes method java.lang.ref.Reference.get 3623 truck.stable.already Invokes method java.lang.ref.Reference.get 3623 truck.stable.already Acesses field android.app.LoadedApk.mClassLoader 3623 truck.stable.already Invokes method java.lang.reflect.Field.get 3623 truck.stable.already Acesses field android.app.LoadedApk.mClassLoader 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.open 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.getInstance 3623 truck.stable.already Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3623 truck.stable.already Invokes method dalvik.system.CloseGuard.get 3623 truck.stable.already -
35 IoCs
Processes:
truck.stable.alreadypid process 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already 3623 truck.stable.already