Overview

overview

10

Static

static

7

4edb08cbf1...cc.apk

android_x86

10

4edb08cbf1...cc.apk

android_x64

10

4edb08cbf1...cc.apk

android_x64

10

Analysis

  • max time kernel
    434550s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    11-04-2022 18:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4edb08cbf1b0dda9b0d087d5bedfe8766bf47ce3fde040f6f86440d184acafcc.apk

  • Size

    2.0MB

  • MD5

    04c28fccb57622f167fb361457fa3c9d

  • SHA1

    0a6365dee1f2f01b61f24d806889e82630dca613

  • SHA256

    4edb08cbf1b0dda9b0d087d5bedfe8766bf47ce3fde040f6f86440d184acafcc

  • SHA512

    10446f6a7973a3d17870ca1c6770d2d29c553ec83995359260a7e5806263df573098fe91d8b8fb8914b0f11d986dc5a83283797663f0b09a2b754fb9c69d2e4d

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://dadmalasvghalclk.digital

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.initial.believe
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:6792
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6960
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7105
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7150
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7198
            • getprop ro.miui.ui.version.name
              2⤵
                PID:7238
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:7270
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:7306

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.initial.believe/app_DynamicOptDex/lAqqa.json
                  Filesize

                  238KB

                  MD5

                  bb3d7fd093fe1a2d3373b3d6edfa5f70

                  SHA1

                  a68eba8a348f815ed71fa9ed59bf1554fca4eedd

                  SHA256

                  f8d7354c15825d014a0e25b1d4f8d858429c4a565a24bceeec13fe5214978ce2

                  SHA512

                  ca8b220ee0be7a6c3731d75e8722f03df3c2fdddca92bba77587b0d5db9b5e6f56e87c2eb06b68f24b05b67f62811dcf4fadee085fa7584446d8ce42e50d904b

                  Download Submit

                • /data/user/0/com.initial.believe/app_DynamicOptDex/lAqqa.json
                  Filesize

                  483KB

                  MD5

                  b425957877841356531563bd060a3dc4

                  SHA1

                  85cb3bea6af72ca3b19688a0128e34a0055430ea

                  SHA256

                  115dbc97b6706ca7f4be81ae7026e45f1ee5fca924cfacf30b8fdfc6a3dc8692

                  SHA512

                  8670c785ded052d3b56181e4089a56859a26855e754f5d957a79ef4a1537d8d7c7aa2770ea8582c3253564d68c30a63216fd343f0bc59e519c5f40d56168ca35

                  Download Submit

                • /data/user/0/com.initial.believe/app_DynamicOptDex/oat/lAqqa.json.cur.prof
                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                  Download Submit