Analysis
-
max time kernel
1621565s -
max time network
151s -
platform
android_x86_64 -
resource
android-x86_64_arm64 -
submitted
23-03-2021 19:47
Static task
static1
Behavioral task
behavioral1
Sample
multimedya.apk
Resource
android-x86_64_arm64
android_x86_64
0 signatures
0 seconds
General
-
Target
multimedya.apk
-
Size
3.6MB
-
MD5
7705b51ef8baa14f13f859bb09aba804
-
SHA1
67549a4d4a7b16f0077806c608a101eca70852c1
-
SHA256
ecc74f5b1b1b8003108e333654b81f43f8ed51e37e219d576c391cb85b4f546d
-
SHA512
a0319e249e974ebfc635db76036db9cacb75e460a924ed6da52fc5cb51ace9a0bd299c6830ed5b4fb5b1cbe3496142823ab4cdd60bd42c34938e7d8211cee1f3
Malware Config
Extracted
Family
alienbot
C2
http://eksilmezlernokta3.club
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Processes:
swarm.hedgehog.earlypid process 4559 swarm.hedgehog.early -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
swarm.hedgehog.earlyioc pid process /data/user/0/swarm.hedgehog.early/app_DynamicOptDex/kmGFHaT.json 4559 swarm.hedgehog.early /data/user/0/swarm.hedgehog.early/app_DynamicOptDex/kmGFHaT.json 4559 swarm.hedgehog.early -
Uses reflection 33 IoCs
Processes:
swarm.hedgehog.earlydescription pid process Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method android.content.res.AssetManager.addAssetPath 4559 swarm.hedgehog.early Invokes method android.app.ContextImpl.getAssets 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method android.content.res.AssetManager.open 4559 swarm.hedgehog.early Invokes method java.io.FilterInputStream.read 4559 swarm.hedgehog.early Invokes method java.io.FilterInputStream.read 4559 swarm.hedgehog.early Invokes method java.io.BufferedInputStream.read 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method java.io.BufferedInputStream.close 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method java.lang.String.getBytes 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method java.io.FileOutputStream.write 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method java.io.BufferedInputStream.close 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method java.io.FilterOutputStream.close 4559 swarm.hedgehog.early Invokes method android.app.ActivityThread.currentActivityThread 4559 swarm.hedgehog.early Acesses field android.app.ActivityThread.mPackages 4559 swarm.hedgehog.early Invokes method java.lang.reflect.Field.get 4559 swarm.hedgehog.early Invokes method java.lang.Object.getClass 4559 swarm.hedgehog.early Invokes method java.lang.ref.Reference.get 4559 swarm.hedgehog.early Invokes method java.lang.ref.Reference.get 4559 swarm.hedgehog.early Acesses field android.app.LoadedApk.mClassLoader 4559 swarm.hedgehog.early Invokes method java.lang.reflect.Field.get 4559 swarm.hedgehog.early Acesses field android.app.LoadedApk.mClassLoader 4559 swarm.hedgehog.early Invokes method dalvik.system.CloseGuard.get 4559 swarm.hedgehog.early Invokes method dalvik.system.CloseGuard.open 4559 swarm.hedgehog.early Invokes method dalvik.system.CloseGuard.get 4559 swarm.hedgehog.early Invokes method dalvik.system.CloseGuard.open 4559 swarm.hedgehog.early Invokes method dalvik.system.CloseGuard.get 4559 swarm.hedgehog.early Invokes method dalvik.system.CloseGuard.open 4559 swarm.hedgehog.early -
64 IoCs
Processes:
swarm.hedgehog.earlypid process 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early 4559 swarm.hedgehog.early