Analysis

  • max time kernel
    1700281s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    20-08-2021 20:52

General

  • Target

    Android_Guncelleme.apk

  • Size

    3.1MB

  • MD5

    3f44e53892fe1ea4abb5eb537ca347f7

  • SHA1

    7514748d3f77056e71055134bb417ee519f460bd

  • SHA256

    463ca1a29f83ee11ed4d37bf6ce314dcad99c8fcfe4ae3e3f7fcc2574f3c70c7

  • SHA512

    cc9e3a6cb21d1105484cfbeb2dcb9c022720aa45ba7c1415a17d9c60f48c512d2ff69d315afbacf4ae029e3e6537f0143c6efda4f41cf852c7f8e3bf4a9a0d6c

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads name of network operator 1 IoCs

    Uses Android APIs to discover system information.

  • Uses reflection 23 IoCs

Processes

  • shop.unlock.subway
    1⤵
    • Loads dropped Dex/Jar
    • Reads name of network operator
    • Uses reflection
    PID:3670

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads