Analysis

  • max time kernel
    1656907s
  • max time network
    175s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    20-08-2021 08:50

General

  • Target

    15642e08cce5fe12a41adbf68f05d7f9ecd9ef5c3440d286db67c3e1c5f88ff7.apk

  • Size

    3.2MB

  • MD5

    c08173bd7c283a0106bc47bd8859c722

  • SHA1

    ffdecd833c8f3b2ef2da97b8ddf0a5642547bba1

  • SHA256

    15642e08cce5fe12a41adbf68f05d7f9ecd9ef5c3440d286db67c3e1c5f88ff7

  • SHA512

    df20ee94e15b267e3706498943f5f785deec8c084f1cf2bba3d6f1bfe3b8796fcd4fe6731c2e05143f135e12fea1413d0872562538805985de37278d3fc86b8e

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads name of network operator 1 IoCs

    Uses Android APIs to discover system information.

  • Uses reflection 11 IoCs

Processes

  • rapid.satoshi.tooth
    1⤵
    • Loads dropped Dex/Jar
    • Reads name of network operator
    • Uses reflection
    PID:3677

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads