Analysis
-
max time kernel
3370975s -
max time network
102s -
platform
android_x86 -
resource
android-x86-arm -
submitted
05-02-2022 08:05
General
-
Target
f2712d1ccadb309f2b482fd2f7118be4707423f8374dd9dfa56dcdda60819ad4.apk
-
Size
1.2MB
-
MD5
d0ee960194950078ba2ef14203557ccd
-
SHA1
9fa0428cc7b57e9a6c5a110cd0e18a8e13790808
-
SHA256
f2712d1ccadb309f2b482fd2f7118be4707423f8374dd9dfa56dcdda60819ad4
-
SHA512
35c5b5155265bff2d03bd9cb4eb9ad365c23bc967dcafdd8f9b439738182908ad566098468ca0bb8442173d1ac7122624da07e110544a702715535c6a1b86451
Malware Config
Extracted
alienbot
http://xancc4fp.online
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
iawhmkptxbtiwoapxkxq.fsxdcqouxqgrqewwnpkuyxjsnsx.myaybhjxsrmfkzmbqomrhdhwqx1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
-
iawhmkptxbtiwoapxkxq.fsxdcqouxqgrqewwnpkuyxjsnsx.myaybhjxsrmfkzmbqomrhdhwqx2⤵
-
-
/system/bin/dex2oat2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4853fe10ce205a2c9e09cb588bbd2696
SHA11a8566d421c30bb7bd9feaa24223a266a1166889
SHA2566aaf7c8dafd625c2e52e3028c8feeb538322e962229f84703891004b5edd4a5a
SHA512bea270f94eb5d047668cee4df79a825905ddf9529e8859fe6f37e091a80e22f5eb179ea1ba5ce43ba7c4a5fa1a461ec52f84b128c5daff9616e6bbe81ea1376b
-
MD5
72c75a418409cd61b01b015e1aea626b
SHA1199b10e865305c28b7c600b49d0bda3e97f2d548
SHA256ff30800bd0eddd7df8ff3d567e0a14d5cd841b0106cf2660d51669b957d8f59b
SHA512797597b85a7f9f1fa357b6f9fdc22a350ea017a0a4fd962697dfe1ca733647702006808edfb64af160a97cb28c0206d81b435218dcb6b2c5c35bec65bd48a898
-
MD5
4853fe10ce205a2c9e09cb588bbd2696
SHA11a8566d421c30bb7bd9feaa24223a266a1166889
SHA2566aaf7c8dafd625c2e52e3028c8feeb538322e962229f84703891004b5edd4a5a
SHA512bea270f94eb5d047668cee4df79a825905ddf9529e8859fe6f37e091a80e22f5eb179ea1ba5ce43ba7c4a5fa1a461ec52f84b128c5daff9616e6bbe81ea1376b