Analysis

  • max time kernel
    4079221s
  • max time network
    105s
  • platform
    android_x86
  • resource
    android-x86-arm
  • submitted
    13-02-2022 12:49

General

  • Target

    fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9.apk

  • Size

    2.2MB

  • MD5

    e08c5968b60e934d3e6d349d3930256f

  • SHA1

    94d87e9eae6cd0c5dfa418797cbd2bb420d0ce5d

  • SHA256

    fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9

  • SHA512

    73f6a7ecf593b694b38899644ebe02ec87172ab9da3fec2b807db8f206ce0bece7db2c1c7312f6878cf5bb8290ad169dc97744eac2361ec2478a2386ca4e1dad

Malware Config

Extracted

Family

alienbot

C2

http://kizmayaprmm.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • eglqpbffxahy.oefrmodhujop.tlk
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:5054
    • eglqpbffxahy.oefrmodhujop.tlk
      2⤵
        PID:5097
      • /system/bin/dex2oat
        2⤵
        • Loads dropped Dex/Jar
        PID:5097

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/eglqpbffxahy.oefrmodhujop.tlk/app_DynamicOptDex/chbaq.json

      MD5

      df5643f97a3fc3ac077b0542a63a6a20

      SHA1

      e288b00f4f7ad4eeb1d741bd0bcb2e465e1c65a2

      SHA256

      db478d211964620e07151ef91f254ec1b38f2837698d9f5fae26fa5fdfed2a8a

      SHA512

      aa9c1d55be97013cb09f16cc8c47dff802c077b32f91275f5733fa17d6fe1511395a5c51255f700492c82b4203002af19e58af9f4f3a46de18646e9636dd68bb

    • /data/user/0/eglqpbffxahy.oefrmodhujop.tlk/app_DynamicOptDex/chbaq.json

      MD5

      96de670ff2e65a9a04a5ca95bfbe2bb4

      SHA1

      0c2bb90c9bea5a663a8ecae1353294bf72015960

      SHA256

      e59cbe686347999c0087e9fa791d788dfee8cb55b5b5f801460a7b3c679a46dc

      SHA512

      de26960deab31800fdc0d6e98630b467b07b9845a9b020ca0cee1b1eb0fddef69401bcfd37bc152a6ca642b1e0c4773f82dc30792dd913b72d1ceaee379d1453

    • /data/user/0/eglqpbffxahy.oefrmodhujop.tlk/app_DynamicOptDex/chbaq.json

      MD5

      df5643f97a3fc3ac077b0542a63a6a20

      SHA1

      e288b00f4f7ad4eeb1d741bd0bcb2e465e1c65a2

      SHA256

      db478d211964620e07151ef91f254ec1b38f2837698d9f5fae26fa5fdfed2a8a

      SHA512

      aa9c1d55be97013cb09f16cc8c47dff802c077b32f91275f5733fa17d6fe1511395a5c51255f700492c82b4203002af19e58af9f4f3a46de18646e9636dd68bb