Overview

overview

10

Static

static

Android APK

android_x86_64

10

Analysis

  • max time kernel
    1516449s
  • max time network
    150s
  • platform
    android_x86_64
  • resource
    android-x86_64
  • submitted
    22-03-2021 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Correos3.22.1.apk

  • Size

    2.9MB

  • MD5

    a94f7795ebd3ee482479f9ec73022db2

  • SHA1

    a068b0e0dd2e8f913b9891dde366b1c9fb9d6222

  • SHA256

    4cb206bfc929e743a65f70a90e781dfb048e40b034e79724e1f785cf001b491f

  • SHA512

    d861238d27d2d75d253d9fc2b9ece737829d1be1fe2f1438991e1a95fe3f38a223ea9edc496b45748a3ded9abf60b074e308c9de92b03249533068dff4ff6f04

Score
10/10
alienbotbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://siopoloiop.ga

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 64 IoCs
    obfuscation
  • 51 IoCs

Processes

  • tortoise.rich.panic
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:3612
    • tortoise.rich.panic
      2⤵
        PID:3659
      • getprop
        2⤵
          PID:3659
        • tortoise.rich.panic
          2⤵
            PID:3738
          • getprop
            2⤵
              PID:3738
            • tortoise.rich.panic
              2⤵
                PID:3773
              • getprop
                2⤵
                  PID:3773
                • tortoise.rich.panic
                  2⤵
                    PID:3816
                  • getprop
                    2⤵
                      PID:3816
                    • tortoise.rich.panic
                      2⤵
                        PID:3866
                      • getprop
                        2⤵
                          PID:3866
                        • tortoise.rich.panic
                          2⤵
                            PID:3896
                          • getprop
                            2⤵
                              PID:3896
                            • tortoise.rich.panic
                              2⤵
                                PID:3930
                              • getprop
                                2⤵
                                  PID:3930

                              Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads