alienbot | c9ae145427e461f558718077545b81ab712b98d97d5a25fb5802be4cd9c13c5c

Analysis

Target

d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa.apk
Size

1.9MB
MD5

c05f39c01d0a631eb235c2dc1e2e3f7b
SHA1

16b001deb9dac8d3e1620329bad18e22634580af
SHA256

d6ba9353f0557aafd8d64c2621c9fbd92aeadaf791a6ba1bde9451bb62e7bbfa
SHA512

123467466e7a009f94632a631073a389361ae92e4f845a05125815533c6108a5b8c37215e6c5d6d9cd82bd316cebe5a6429928761a599468d874b9e9b2ed6bb1

Score

10^/10

Family

alienbot

http://weatherforeveryday.site

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	com.jar.flower

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.jar.flower/app_DynamicOptDex/Omnls.json	3812	com.jar.flower

com.jar.flower
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3812
- com.jar.flower
  2⤵
  PID:3883
- getprop
  2⤵
  PID:3883
- com.jar.flower
  2⤵
  PID:3939
- getprop
  2⤵
  PID:3939
- com.jar.flower
  2⤵
  PID:3965
- getprop
  2⤵
  PID:3965
- com.jar.flower
  2⤵
  PID:4002
- getprop
  2⤵
  PID:4002
- com.jar.flower
  2⤵
  PID:4029
- getprop
  2⤵
  PID:4029
- com.jar.flower
  2⤵
  PID:4060
- getprop
  2⤵
  PID:4060