Bad Zip and new Packer for Android/BianLian

I got my hands on a new sample of Android/BianLian (sha256: 0070bc10699a982a26f6da48452b8f5e648e1e356a7c1667f393c5c3a1150865), a banking botnet I have been tracking for months (no, years).

On December 14, 2023, there are 6 active C&C for Android/BianLian botnet. This is a partial list which shows (1) a known active C&C (“UP”), (2) a new active C&C (“NEW”) and (3) an old C&C which is no longer active.

Attempt to unpack #1

As most samples are packed nowadays, I directly through it into Kavanoz …

android far issue malformed malware analysis manifest medusa packer patching payload process sample unpacking visible wrong zip