Analysis
-
max time kernel
651827s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm -
submitted
23-02-2022 13:49
General
-
Target
d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa.apk
-
Size
1.9MB
-
MD5
c05f39c01d0a631eb235c2dc1e2e3f7b
-
SHA1
16b001deb9dac8d3e1620329bad18e22634580af
-
SHA256
d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa
-
SHA512
123467466e7a009f94632a631073a389361ae92e4f845a05125815533c6108a5b8c37215e6c5d6d9cd82bd316cebe5a6429928761a599468d874b9e9b2ed6bb1
Malware Config
Extracted
alienbot
http://weatherforeveryday.site
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
com.jar.flower1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
-
com.jar.flower2⤵
-
-
/system/bin/dex2oat2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
029851f108afb10e85e63b9598ef8df9
SHA13088faf22e8972f7d46f8d5bd99efe27da7bb09b
SHA2565c4f377657377ee9de3aeb9580edae8d4f3dd25aa381a0d01552cea5acf88013
SHA512d126aabcec1ab065f3e9ab150c85598be6703acb5ee8954a10cee2fa0db3f100e77938267532e05716103092c06116caf092875c89bab79c7b746a3ebae721b0
-
MD5
3c66ef052da261eaa600c3233dcd8904
SHA174eb88d29e76fb0ed92e43f9bbe984b685c93f01
SHA25643dd16352600970908431eb21b6464543db71ea002681151447793b6d74612cc
SHA51262f9de427a9837472bd23f902d93e492f28eff172e834cd47ecadb0380e5f866efaee6810467256488c3b153d260d20b7ec7379f9bdce8af97f81af90b25eff1