Analysis
-
max time kernel
2213443s -
platform
android_x86 -
resource
android-x86-arm -
submitted
15-10-2021 12:28
Static task
static1
Behavioral task
behavioral1
Sample
Aleyna_Tilki_Ifsa.apk
Resource
android-x86-arm
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Aleyna_Tilki_Ifsa.apk
Resource
android-x64-arm64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Aleyna_Tilki_Ifsa.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
Aleyna_Tilki_Ifsa.apk
-
Size
3.1MB
-
MD5
63e94222fde7ff90ddd81341c409f148
-
SHA1
4a911259cc5fb7b3312fb5c41435d05819cf4b81
-
SHA256
fdd9db26f25d0d784b5692003f46320d8400266b6573d5c8ec6dd6c4e2e7bc72
-
SHA512
aad056f2a5c4ef62e5810cc56d29e618de7f4d2c263307759306a2ff9060cb6959b94fa21cbc68fef13ef2f430fa4ef2df11e5e751cbc909a44bbdc5b86238f9
Malware Config
Extracted
Family
cerberus
C2
http://161.97.68.93
Signatures
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.coast.rather/app_DynamicOptDex/okGmNq.json 4848 com.coast.rather /data/user/0/com.coast.rather/app_DynamicOptDex/okGmNq.json 4873 /system/bin/dex2oat /data/user/0/com.coast.rather/app_DynamicOptDex/okGmNq.json 4848 com.coast.rather -
Uses reflection 1 IoCs
description pid Process Invokes method android.content.pm.PackageManager.isInstantApp 4848 com.coast.rather