Analysis
-
max time kernel
3403220s -
max time network
119s -
platform
android_x86 -
resource
android-x86-arm -
submitted
05-02-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
34be7f167509a674e47ff84f80cb97b406f595ec4d08102cfeeb351632e84378.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
34be7f167509a674e47ff84f80cb97b406f595ec4d08102cfeeb351632e84378.apk
Resource
android-x64
Behavioral task
behavioral3
Sample
34be7f167509a674e47ff84f80cb97b406f595ec4d08102cfeeb351632e84378.apk
Resource
android-x64-arm64
General
-
Target
34be7f167509a674e47ff84f80cb97b406f595ec4d08102cfeeb351632e84378.apk
-
Size
300KB
-
MD5
b50672205ed2763ba6816093c2a3676e
-
SHA1
25ae730c962ff32c06f853cd4bf0081041a29ce2
-
SHA256
34be7f167509a674e47ff84f80cb97b406f595ec4d08102cfeeb351632e84378
-
SHA512
0afd47fa337bd205795081517554d8be47bfd270f6965ecd8c810cf66a737be8eb3b226929d64f17695053cefeb54d250670bad9631fcb7eb8597e456964407d
Malware Config
Extracted
alienbot
http://optimpres.xyz/
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
com.tcpf.deqfwqigdescription ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tcpf.deqfwqig