alienbot | 00c462f5b13e3bf21cc7b913719188644fac34cfb7a80893d551bbf512bb8570 | Triage™

Resubmissions

19/08/2021, 20:43

210819-pbd498x85610

19/08/2021, 20:35

210819-sqjexdpt7e10

Analysis

max time kernel
1613340s
max time network
129s
platform
android_x64
resource
android-x64-arm64
submitted
19/08/2021, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome505543.apk
Size 3.9MB
Sample210819-pbd498x856
SHA256 00c462f5b13e3bf21cc7b913719188644fac34cfb7a80893d551bbf512bb8570
MD5 73f666b3dc5ee66e202b3e365a524d5d
SHA1 3195a268d5fe4c181cf4178322afe629b03f1064
SHA512 5abd49342885a144ae0284cd258fd3ba2a8311b6c932e2fe5619dc89e3947f9c7478978d44c836c4348f17d73f51c9ce4516d2dc204e9b93d800720d1cb9217c
MD5 SHA1 SHA512

Score

10^/10

alienbot banker infostealer obfuscation trojan

Malware Config

Extracted

Family

alienbot

C2

http://a05qdzfe6qa1.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/there.discovery.excitement/app_DynamicOptDex/dEVDuX.json	4125	there.discovery.excitement

Uses reflection 3 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4125	there.discovery.excitement
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4125	there.discovery.excitement
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4125	there.discovery.excitement

there.discovery.excitement
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4125
- there.discovery.excitement
  2⤵
  PID:6495
- there.discovery.excitement
  2⤵
  PID:6611
- there.discovery.excitement
  2⤵
  PID:6681

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads