Analysis
-
max time kernel
2745614s -
max time network
194s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
08/05/2022, 09:03
General
-
Target
459e7ad6f07c0ee47495859317ca81fb55903d821f8f769a8bb4f97aecd3a79a.apk
-
Size
2.3MB
-
MD5
ff0d447420e161800fb357f3a1339bab
-
SHA1
3c204174bd1faa5e14796d0fc929d632c4dbf8c9
-
SHA256
459e7ad6f07c0ee47495859317ca81fb55903d821f8f769a8bb4f97aecd3a79a
-
SHA512
4a50face9298a587e8dbfe88af5b0057218e6fb121e026287f7f59bf2fafe1d9f1366063692e13e68dde04706a86ba8d3515645fe1b846b69d97fe159c6d7f6e
Malware Config
Extracted
alienbot
http://benibankagibisoy.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
pqlnmjiplfbbbbqicat.gmnyhpllflubgrqg.zmmxh1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
686KB
MD5f9e60bd1297d3411f4b772c74f40adb6
SHA19c84a30b9459a74a3b7b147397798929f550a241
SHA25612166f8bca8b67f6b642fb8327e5f57aa6ed36cee9846fa20437960ddb1d299e
SHA512ba21860584b223a7f707cdc722cd3c2d2cabc9d73873230d72384b469f7efe9bbc2d99f022dd4b4a74cc5fafaa49f92c954b8b6395d08cd196bc35988c61b113
-
Filesize
686KB
MD5891420db63e2a4ec156b5179938dfb48
SHA16a0ffe94cb303d75d755a53c88cc57d24208da8d
SHA25681073350c5528c3f2d854f3daa4294a7b9410d6ce205c66a0fc14260718cf39c
SHA51219777af392955842e8aa77639098a9653b2baece13406bf66fb95431fff8f9011a5e508db54337389e3eab1fa06ececbb641a2ffbc70abf03cf7f4a0e9c2c56c
-
Filesize
686KB
MD5891420db63e2a4ec156b5179938dfb48
SHA16a0ffe94cb303d75d755a53c88cc57d24208da8d
SHA25681073350c5528c3f2d854f3daa4294a7b9410d6ce205c66a0fc14260718cf39c
SHA51219777af392955842e8aa77639098a9653b2baece13406bf66fb95431fff8f9011a5e508db54337389e3eab1fa06ececbb641a2ffbc70abf03cf7f4a0e9c2c56c