Analysis
-
max time kernel
1498610s -
platform
android_x86 -
resource
android-x86-arm -
submitted
18-08-2021 12:50
Static task
static1
Behavioral task
behavioral1
Sample
cfba696dc3b975552566d3ec7d47e6624b863bc79e90889d4021966966c05f1a.apk
Resource
android-x86-arm
0 signatures
0 seconds
General
-
Target
cfba696dc3b975552566d3ec7d47e6624b863bc79e90889d4021966966c05f1a.apk
-
Size
3.1MB
-
MD5
f820a0b768098cb585e1126a49775284
-
SHA1
ee2e3e817f611555f75e48f5648e520d37c6f897
-
SHA256
cfba696dc3b975552566d3ec7d47e6624b863bc79e90889d4021966966c05f1a
-
SHA512
3edc90eafbfbf65a7e05e34715aac891b423f7ef5e0fa1e0d797c9f91531eb7cf6e379ac593111b8b858f78475e3a52875edc4749e275c14070258c5bde006f4
Score
10/10
Malware Config
Extracted
Family
alienbot
C2
http://tayderik.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/pilot.guess.town/app_DynamicOptDex/HJykQ.json 4991 pilot.guess.town /data/user/0/pilot.guess.town/app_DynamicOptDex/HJykQ.json 5015 /system/bin/dex2oat /data/user/0/pilot.guess.town/app_DynamicOptDex/HJykQ.json 4991 pilot.guess.town -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS pilot.guess.town -
Uses reflection 14 IoCs
description pid Process Invokes method android.content.pm.PackageManager.isInstantApp 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.get 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.open 4991 pilot.guess.town Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.get 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.open 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.get 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.open 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.get 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.open 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.get 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.open 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.get 4991 pilot.guess.town Invokes method dalvik.system.CloseGuard.open 4991 pilot.guess.town