Analysis
-
max time kernel
652561s -
max time network
145s -
platform
android_x86 -
resource
android-x86-arm -
submitted
23/02/2022, 14:01
General
-
Target
d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa.apk
-
Size
1.9MB
-
MD5
c05f39c01d0a631eb235c2dc1e2e3f7b
-
SHA1
16b001deb9dac8d3e1620329bad18e22634580af
-
SHA256
d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa
-
SHA512
123467466e7a009f94632a631073a389361ae92e4f845a05125815533c6108a5b8c37215e6c5d6d9cd82bd316cebe5a6429928761a599468d874b9e9b2ed6bb1
Score
10/10
Malware Config
Extracted
Family
alienbot
C2
http://weatherforeveryday.site
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
Processes
-
com.jar.flower1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
-
com.jar.flower2⤵
-
-
/system/bin/dex2oat2⤵
- Loads dropped Dex/Jar
-