Analysis
-
max time kernel
4007328s -
max time network
126s -
platform
android_x86_64 -
resource
android-x86_64 -
submitted
20-04-2021 10:34
Static task
static1
Behavioral task
behavioral1
Sample
Android_Guncelleme.apk
Resource
android-x86_64
android_x86_64
0 signatures
0 seconds
General
-
Target
Android_Guncelleme.apk
-
Size
3.2MB
-
MD5
95e28bb8af6e9a6dd7cbc2ee39bac56f
-
SHA1
42018369d2b45d9f479c7b3453af54d1c170a568
-
SHA256
f3c9d5ce9180f7e8177bf1e8a6e1a42b7c8504ce3c723437a3f2b8b6acab7e42
-
SHA512
3ca841addff26ba211a44a494b503a3fa4e74de99741c02c7849f4512f3682024ee5105c564def14ecc31cfc5e88802b17263775b0f9e8be123c31c76a664fe8
Malware Config
Extracted
Family
alienbot
C2
http://seninle1tik.digital
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Processes:
repair.team.roastpid process 3627 repair.team.roast 3627 repair.team.roast 3627 repair.team.roast 3627 repair.team.roast 3627 repair.team.roast -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
repair.team.roastioc pid process /data/user/0/repair.team.roast/app_DynamicOptDex/xb.json 3627 repair.team.roast /data/user/0/repair.team.roast/app_DynamicOptDex/xb.json 3627 repair.team.roast -
Uses reflection 42 IoCs
Processes:
repair.team.roastdescription pid process Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method android.content.res.AssetManager.addAssetPath 3627 repair.team.roast Invokes method android.app.ContextImpl.getAssets 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method android.content.res.AssetManager.open 3627 repair.team.roast Invokes method java.io.FilterInputStream.read 3627 repair.team.roast Invokes method java.io.FilterInputStream.read 3627 repair.team.roast Invokes method java.io.BufferedInputStream.read 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method java.io.BufferedInputStream.close 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method java.lang.String.getBytes 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method java.io.FileOutputStream.write 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method java.io.BufferedInputStream.close 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method java.io.FilterOutputStream.close 3627 repair.team.roast Invokes method android.app.ActivityThread.currentActivityThread 3627 repair.team.roast Acesses field android.app.ActivityThread.mPackages 3627 repair.team.roast Invokes method java.lang.reflect.Field.get 3627 repair.team.roast Invokes method java.lang.Object.getClass 3627 repair.team.roast Invokes method java.lang.ref.Reference.get 3627 repair.team.roast Invokes method java.lang.ref.Reference.get 3627 repair.team.roast Acesses field android.app.LoadedApk.mClassLoader 3627 repair.team.roast Invokes method java.lang.reflect.Field.get 3627 repair.team.roast Acesses field android.app.LoadedApk.mClassLoader 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.get 3627 repair.team.roast Invokes method dalvik.system.CloseGuard.open 3627 repair.team.roast
Processes
-
repair.team.roast1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses reflection
-
repair.team.roast2⤵
-
getprop2⤵
-
repair.team.roast2⤵
-
getprop2⤵
-
repair.team.roast2⤵
-
getprop2⤵
-
repair.team.roast2⤵
-
getprop2⤵