alienbot | 2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9 | Triage™

Analysis

max time kernel
2089118s
max time network
205s
platform
android_x64
resource
android-x64
submitted
21/01/2022, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9.apk
Size 1.8MB
Sample220121-n63hlahaa3
SHA256 2cf092c936471d14d3ee6718cd51b59a0ed4476786fa367c81e9e0f6c310e0b9
MD5 5bb57271f13250023aabd63191de4879
SHA1 5185cd06cc07e4719fa47760511263454e3e6201
SHA512 df9e3da08c8063d7783a980b76950c545c995b2eaeddbbbc24968316c95b4f577b78433ce67b6442daf8fa2ec1a18bf68b670783ca75d3a2dec0d8824c8ad1a3
MD5 SHA1 SHA512

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://yoklesfomerdesgomres.net

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.era.regular/app_DynamicOptDex/RgCcOcQ.json	3859	com.era.regular

com.era.regular
1⤵
- Loads dropped Dex/Jar
PID:3859
- com.era.regular
  2⤵
  PID:3930
- getprop
  2⤵
  PID:3930
- com.era.regular
  2⤵
  PID:3988
- getprop
  2⤵
  PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads