Overview

overview

10

Static

static

Android APK

android_x86_64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Evdeyim.apk

  • Size

    2.3MB

  • Sample

    201212-6jnzdw924j

  • MD5

    3bfd4d18a3ceb4fb378772f1e4d1540c

  • SHA1

    5f9926d498c3cd78fd99244cdd9f92de3a0eebc1

  • SHA256

    bce447711725ad9106a0094d25220103b1bf4ba83bc247b3662ff4a6bfe9c67e

  • SHA512

    dd841f39db5569e6ab1090eb0633f1370911edea38debc6621b57287d09063450c23a3b3f33b4e93269cda72a5c984537c03219a82cde834b202e5249c333f5a

Score
10/10
alienbotandroidbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://asf12552fg.xyz

Targets

    • Target

      Evdeyim.apk

    • Size

      2.3MB

    • MD5

      3bfd4d18a3ceb4fb378772f1e4d1540c

    • SHA1

      5f9926d498c3cd78fd99244cdd9f92de3a0eebc1

    • SHA256

      bce447711725ad9106a0094d25220103b1bf4ba83bc247b3662ff4a6bfe9c67e

    • SHA512

      dd841f39db5569e6ab1090eb0633f1370911edea38debc6621b57287d09063450c23a3b3f33b4e93269cda72a5c984537c03219a82cde834b202e5249c333f5a

    Score
    10/10
    alienbotbankerinfostealerobfuscationstealthtrojan

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

      bankertrojaninfostealeralienbot

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

    behavioral1

MITRE ATT&CK Matrix

Tasks