Analysis

  • max time kernel
    1610953s
  • platform
    android_x86
  • resource
    android-x86-arm
  • submitted
    19-08-2021 20:03

General

  • Target

    Chrome546758.apk

  • Size

    3.9MB

  • MD5

    894fe2772e0dcacb289aec6c2e270309

  • SHA1

    8e7dce465a012b44541f2d69706712dca633477a

  • SHA256

    1cd7bab3a22cf44741925eb1ee5f969ccca01ff78ce6f3f010fdf6f93875c8fb

  • SHA512

    71ce5ce44c6d9679aef9420552990e26ae634ad4c2ca293ce1c22002f794029c5253d3653f1114ca0e8d5eba7ad49517539c7bfd6e8a6e6e01061703ab3640cd

Malware Config

Extracted

Family

alienbot

C2

http://a05qdzfe6qa1.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 2 IoCs

Processes

  • array.exactly.principal
    1⤵
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:4982
    • array.exactly.principal
      2⤵
        PID:5016
      • /system/bin/dex2oat
        2⤵
        • Loads dropped Dex/Jar
        PID:5016

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads