Analysis
-
max time kernel
1700281s -
max time network
155s -
platform
android_x64 -
resource
android-x64 -
submitted
20-08-2021 20:52
Static task
static1
Behavioral task
behavioral1
Sample
Android_Guncelleme.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
Android_Guncelleme.apk
-
Size
3.1MB
-
MD5
3f44e53892fe1ea4abb5eb537ca347f7
-
SHA1
7514748d3f77056e71055134bb417ee519f460bd
-
SHA256
463ca1a29f83ee11ed4d37bf6ce314dcad99c8fcfe4ae3e3f7fcc2574f3c70c7
-
SHA512
cc9e3a6cb21d1105484cfbeb2dcb9c022720aa45ba7c1415a17d9c60f48c512d2ff69d315afbacf4ae029e3e6537f0143c6efda4f41cf852c7f8e3bf4a9a0d6c
Score
10/10
Malware Config
Extracted
Family
alienbot
C2
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/shop.unlock.subway/app_DynamicOptDex/Bc.json 3670 shop.unlock.subway /data/user/0/shop.unlock.subway/app_DynamicOptDex/Bc.json 3670 shop.unlock.subway -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName shop.unlock.subway -
Uses reflection 23 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3670 shop.unlock.subway Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3670 shop.unlock.subway Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.get 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.open 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.getInstance 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.get 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.open 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.getInstance 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.get 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.open 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.getInstance 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.get 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.open 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.getInstance 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.get 3670 shop.unlock.subway Invokes method dalvik.system.CloseGuard.open 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.getInstance 3670 shop.unlock.subway Invokes method android.security.NetworkSecurityPolicy.isCleartextTrafficPermitted 3670 shop.unlock.subway