Analysis
-
max time kernel
2320647s -
max time network
78s -
platform
android_x64 -
resource
android-x64 -
submitted
16-10-2021 18:14
Static task
static1
Behavioral task
behavioral1
Sample
ALEYNA_TILKI_IFSA_build_obf_4.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
ALEYNA_TILKI_IFSA_build_obf_4.apk
-
Size
2.9MB
-
MD5
62f5db5df34e50de3092e3e15b64de99
-
SHA1
a7bd3e84616fc6017b8085b777106e1932330a4a
-
SHA256
a09e1cf2e6514a984917f749815861f8dc3730164fa5ba92c50628ff948d38d9
-
SHA512
4aa14359c6eaafd1b84195bb02bb64ec255bd21e4a531ddd674f282a82ddd17df4ef667285a08d2b420d1c7c57f87c04d53664eaa217ce5ec23c5bea24b1bdca
Malware Config
Extracted
Family
cerberus
C2
http://161.97.68.93
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.any.steak/app_DynamicOptDex/oynGR.json 3711 com.any.steak /data/user/0/com.any.steak/app_DynamicOptDex/oynGR.json 3711 com.any.steak /product/app/webview/webview.apk 3711 com.any.steak /product/app/webview/webview.apk 3711 com.any.steak -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.any.steak -
Uses reflection 3 IoCs
description pid Process Invokes method android.content.Context.bindServiceAsUser 3711 com.any.steak Invokes method android.content.Context.bindServiceAsUser 3711 com.any.steak Invokes method android.content.Context.bindServiceAsUser 3711 com.any.steak