Overview

overview

10

Static

static

Android APK

android_x86_64

10

Analysis

  • max time kernel
    1277451s
  • max time network
    134s
  • platform
    android_x86_64
  • resource
    android-x86_64
  • submitted
    19-03-2021 20:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b5141a34167d62ecc823b792f5e69fb98c247945394b93e1547fd29c11b093d2.apk

  • Size

    3.0MB

  • MD5

    e27735ebf7edd8776463c6422d5344e9

  • SHA1

    0c2a5bf1503c62be6bb31cb46a20f6151cb2a19e

  • SHA256

    b5141a34167d62ecc823b792f5e69fb98c247945394b93e1547fd29c11b093d2

  • SHA512

    7dda963a7fea88f15b2965e965523bbc7ec9fd3802ed147f916984e0294832bcbc8b6dd1ef6397bbe44b60690c888fd2601d496a6da04961c50ac9d0a3a65320

Score
10/10
alienbotbankerinfostealerobfuscationstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://lwk25kl2424.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 44 IoCs
    obfuscation
  • 43 IoCs

Processes

  • adjust.disagree.enroll
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:3611
    • adjust.disagree.enroll
      2⤵
        PID:3658
      • getprop
        2⤵
          PID:3658
        • adjust.disagree.enroll
          2⤵
            PID:3754
          • getprop
            2⤵
              PID:3754
            • adjust.disagree.enroll
              2⤵
                PID:3790
              • getprop
                2⤵
                  PID:3790
                • adjust.disagree.enroll
                  2⤵
                    PID:3836
                  • getprop
                    2⤵
                      PID:3836
                    • adjust.disagree.enroll
                      2⤵
                        PID:3874
                      • getprop
                        2⤵
                          PID:3874
                        • adjust.disagree.enroll
                          2⤵
                            PID:3904
                          • getprop
                            2⤵
                              PID:3904
                            • adjust.disagree.enroll
                              2⤵
                                PID:3935
                              • getprop
                                2⤵
                                  PID:3935

                              Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads