alienbot | 4f1ff96fb54960d94e96fd605460408ad65ad300ee479088d0e27cdda073db5a | Triage™

Analysis

max time kernel
4079545s
max time network
160s
platform
android_x64
resource
android-x64
submitted
13/02/2022, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f1ff96fb54960d94e96fd605460408ad65ad300ee479088d0e27cdda073db5a.apk
Size 1.5MB
Sample220213-p26j5aaaa4
SHA256 4f1ff96fb54960d94e96fd605460408ad65ad300ee479088d0e27cdda073db5a
MD5 8a7abefb0fc3b5f164a0179faccb8729
SHA1 2f84528d11e2107f273ef4ef1e4ec87d59c65509
SHA512 81180721372166546a01de6781dd91401eb10fecd4ad736be0c33c54510cccca1d6e14bfac9585df3e07bfdf9e6574d753e0ba8365dbbfeed5b95623e2212809
MD5 SHA1 SHA512

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://oqpls.top

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	sfga.yyh.mgufpnpnxowplrotzbig

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/sfga.yyh.mgufpnpnxowplrotzbig/app_DynamicOptDex/lAsyd.json	3809	sfga.yyh.mgufpnpnxowplrotzbig
/data/user/0/sfga.yyh.mgufpnpnxowplrotzbig/app_DynamicOptDex/lAsyd.json	3809	sfga.yyh.mgufpnpnxowplrotzbig

sfga.yyh.mgufpnpnxowplrotzbig
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3809
- sfga.yyh.mgufpnpnxowplrotzbig
  2⤵
  PID:3887
- getprop
  2⤵
  PID:3887
- sfga.yyh.mgufpnpnxowplrotzbig
  2⤵
  PID:3938
- getprop
  2⤵
  PID:3938

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads