Overview

overview

10

Static

static

Android APK

android_x86_64

10

Analysis

  • max time kernel
    1203455s
  • max time network
    152s
  • platform
    android_x86_64
  • resource
    android-x86_64
  • submitted
    07-05-2021 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DestekBasvuruFormu.apk

  • Size

    2.8MB

  • MD5

    e763207653ee9506e09c10ef43090faa

  • SHA1

    1856ebdd170ca8abc15cc38dc065190997f141eb

  • SHA256

    96ab53899db38080f89781aa6e0b3826fbdc4d650e781a4faba9b49a1f96b560

  • SHA512

    6b29b7cb99ce686606172586a1af94c4c9a1bac3e7c5c7b8b98f6f8c47f6bd8a5f8ce9ec9a113dffc2d08454bb9bac1a107859d1d54e307b0638a96f259f318a

Score
10/10
alienbotbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://seymidostm0214.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Removes its main activity from the application launcher 7 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 55 IoCs
    obfuscation

Processes

  • time.rhythm.rent
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:3615
    • time.rhythm.rent
      2⤵
        PID:3669
      • getprop
        2⤵
          PID:3669
        • time.rhythm.rent
          2⤵
            PID:3753
          • getprop
            2⤵
              PID:3753
            • time.rhythm.rent
              2⤵
                PID:3787
              • getprop
                2⤵
                  PID:3787
                • time.rhythm.rent
                  2⤵
                    PID:3823
                  • getprop
                    2⤵
                      PID:3823
                    • time.rhythm.rent
                      2⤵
                        PID:3854
                      • getprop
                        2⤵
                          PID:3854
                        • time.rhythm.rent
                          2⤵
                            PID:3889
                          • getprop
                            2⤵
                              PID:3889

                          Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads