Analysis
-
max time kernel
2213388s -
max time network
58s -
platform
android_x64 -
resource
android-x64 -
submitted
15-10-2021 12:28
Static task
static1
Behavioral task
behavioral1
Sample
Aleyna_Tilki_Ifsa.apk
Resource
android-x86-arm
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Aleyna_Tilki_Ifsa.apk
Resource
android-x64-arm64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Aleyna_Tilki_Ifsa.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
Aleyna_Tilki_Ifsa.apk
-
Size
3.1MB
-
MD5
63e94222fde7ff90ddd81341c409f148
-
SHA1
4a911259cc5fb7b3312fb5c41435d05819cf4b81
-
SHA256
fdd9db26f25d0d784b5692003f46320d8400266b6573d5c8ec6dd6c4e2e7bc72
-
SHA512
aad056f2a5c4ef62e5810cc56d29e618de7f4d2c263307759306a2ff9060cb6959b94fa21cbc68fef13ef2f430fa4ef2df11e5e751cbc909a44bbdc5b86238f9
Malware Config
Extracted
Family
cerberus
C2
http://161.97.68.93
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.coast.rather/app_DynamicOptDex/okGmNq.json 3661 com.coast.rather /data/user/0/com.coast.rather/app_DynamicOptDex/okGmNq.json 3661 com.coast.rather /product/app/webview/webview.apk 3661 com.coast.rather /product/app/webview/webview.apk 3661 com.coast.rather -
Uses reflection 2 IoCs
description pid Process Invokes method android.content.Context.bindServiceAsUser 3661 com.coast.rather Invokes method android.content.Context.bindServiceAsUser 3661 com.coast.rather