alienbot | 2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72

Analysis

Target

2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72.apk
Size

1.5MB
MD5

c4693822db3636a03cbfc607550b19ac
SHA1

52c16ec013db6f2854123e6b21d5686ef453bfbd
SHA256

2b2d0dd04e272ea821c114a8366efc7651c56a548af2d488d8616bb25682cb72
SHA512

60506b38da5c1bb405e82b5450dda7fafb68397d232730a252698cfc2633d02288e101862d0e76ebef4cc3684327c273e9599adbeb74bcc98e48406847773f1a

Score

10^/10

Family

alienbot

http://darkwhitechoco.top

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq/app_DynamicOptDex/Yltq.json	3814	mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
/data/user/0/mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq/app_DynamicOptDex/Yltq.json	3814	mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq

mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3814
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:3870
- getprop
  2⤵
  PID:3870
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:3936
- getprop
  2⤵
  PID:3936
- mnogftledxsehzfrsotw.wzwywztggscgfzmqyudxoql.snmewxuczyrzkocstclxtuqyohq
  2⤵
  PID:3962