Analysis
- max time kernel
904614s - max time network
155s - platform
android_x86 - resource
android-x86-arm - submitted
11/08/2021, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
Porno_Izle.apk
Resource
android-x86-arm
android_x86
0 signatures
0 seconds
General
- Target Porno_Izle.apk
- Size 2.8MB
- Sample210811-8llbb3dx32
- SHA256 afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830
- MD5 24b12a6b58a37dfa57a7563883efabea
- SHA1 0a93e315530ac6a65f701869bebfd48c7ca40486
- SHA512 e6ba864194558ee1afd82e2edf84412e76c45f3c4d31f07f241bf29fbedaceca855b29e31ef283ab536c7533e326218ccb3a3201634fc23e83fc29f7cfd77cf6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
alienbot
C2
-
http://194.163.136.78
Signatures
- Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
- Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json 4674 asset.margin.pipe /data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json 4724 /system/bin/dex2oat /data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json 4674 asset.margin.pipe - Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName asset.margin.pipe - Uses reflection 38 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4674 asset.margin.pipe Invokes method android.content.pm.PackageManager.isInstantApp 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.get 4674 asset.margin.pipe Invokes method dalvik.system.CloseGuard.open 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.getInstance 4674 asset.margin.pipe Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 4674 asset.margin.pipe