Overview

overview

10

Static

static

Android APK

android_x86_64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pandemdest.apk

  • Size

    1.9MB

  • Sample

    201120-2162bsle62

  • MD5

    8b219d57fafcdb3b2e0d053d344c98c8

  • SHA1

    566bdae1390d8e9c910064c9f4a3812f3abc9a67

  • SHA256

    87cff4f61b32306eaec1f50af02d0521937aadd6f1c1a3b3d5ea177ebe690f47

  • SHA512

    53d4fb2e8b2e2269968e93cf3d5d18e3a8d3ce82f44a9f9324ad84c7103e36746099a2ca7f6d656d11e75e9253cd9fb37053afcea6c144d727353a0da208f690

Score
10/10
alienbotandroidbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://ricktreemonkey54st.com

Targets

    • Target

      pandemdest.apk

    • Size

      1.9MB

    • MD5

      8b219d57fafcdb3b2e0d053d344c98c8

    • SHA1

      566bdae1390d8e9c910064c9f4a3812f3abc9a67

    • SHA256

      87cff4f61b32306eaec1f50af02d0521937aadd6f1c1a3b3d5ea177ebe690f47

    • SHA512

      53d4fb2e8b2e2269968e93cf3d5d18e3a8d3ce82f44a9f9324ad84c7103e36746099a2ca7f6d656d11e75e9253cd9fb37053afcea6c144d727353a0da208f690

    Score
    10/10
    alienbotbankerinfostealerobfuscationstealthtrojan

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

      bankertrojaninfostealeralienbot

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

    behavioral1

MITRE ATT&CK Matrix

Tasks