Analysis
-
max time kernel
4079221s -
max time network
105s -
platform
android_x86 -
resource
android-x86-arm -
submitted
13-02-2022 12:49
Static task
static1
Behavioral task
behavioral1
Sample
fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9.apk
Resource
android-x64
Behavioral task
behavioral3
Sample
fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9.apk
Resource
android-x64-arm64
General
-
Target
fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9.apk
-
Size
2.2MB
-
MD5
e08c5968b60e934d3e6d349d3930256f
-
SHA1
94d87e9eae6cd0c5dfa418797cbd2bb420d0ce5d
-
SHA256
fd1d1e2dbca02997ce1905dc74f056a6906695f7f9ac5498edfff735a4c55bf9
-
SHA512
73f6a7ecf593b694b38899644ebe02ec87172ab9da3fec2b807db8f206ce0bece7db2c1c7312f6878cf5bb8290ad169dc97744eac2361ec2478a2386ca4e1dad
Malware Config
Extracted
alienbot
http://kizmayaprmm.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
eglqpbffxahy.oefrmodhujop.tlkdescription ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId eglqpbffxahy.oefrmodhujop.tlk -
Acquires the wake lock. 1 IoCs
Processes:
eglqpbffxahy.oefrmodhujop.tlkdescription ioc Process Framework service call android.os.IPowerManager.acquireWakeLock eglqpbffxahy.oefrmodhujop.tlk -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
eglqpbffxahy.oefrmodhujop.tlk/system/bin/dex2oatioc pid Process /data/user/0/eglqpbffxahy.oefrmodhujop.tlk/app_DynamicOptDex/chbaq.json 5054 eglqpbffxahy.oefrmodhujop.tlk /data/user/0/eglqpbffxahy.oefrmodhujop.tlk/app_DynamicOptDex/chbaq.json 5097 /system/bin/dex2oat /data/user/0/eglqpbffxahy.oefrmodhujop.tlk/app_DynamicOptDex/chbaq.json 5054 eglqpbffxahy.oefrmodhujop.tlk
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
df5643f97a3fc3ac077b0542a63a6a20
SHA1e288b00f4f7ad4eeb1d741bd0bcb2e465e1c65a2
SHA256db478d211964620e07151ef91f254ec1b38f2837698d9f5fae26fa5fdfed2a8a
SHA512aa9c1d55be97013cb09f16cc8c47dff802c077b32f91275f5733fa17d6fe1511395a5c51255f700492c82b4203002af19e58af9f4f3a46de18646e9636dd68bb
-
MD5
96de670ff2e65a9a04a5ca95bfbe2bb4
SHA10c2bb90c9bea5a663a8ecae1353294bf72015960
SHA256e59cbe686347999c0087e9fa791d788dfee8cb55b5b5f801460a7b3c679a46dc
SHA512de26960deab31800fdc0d6e98630b467b07b9845a9b020ca0cee1b1eb0fddef69401bcfd37bc152a6ca642b1e0c4773f82dc30792dd913b72d1ceaee379d1453
-
MD5
df5643f97a3fc3ac077b0542a63a6a20
SHA1e288b00f4f7ad4eeb1d741bd0bcb2e465e1c65a2
SHA256db478d211964620e07151ef91f254ec1b38f2837698d9f5fae26fa5fdfed2a8a
SHA512aa9c1d55be97013cb09f16cc8c47dff802c077b32f91275f5733fa17d6fe1511395a5c51255f700492c82b4203002af19e58af9f4f3a46de18646e9636dd68bb