Analysis

  • max time kernel
    2747287s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    08/05/2022, 09:16

General

  • Target

    4d8344cc821d3077fd54ff3b6aa485cbdc13f746a21950a46dc944a80117028a.apk

  • Size

    2.4MB

  • MD5

    c14b4c842993b2a9b4a284556f79652c

  • SHA1

    0dd33a7bb6e5d540a67a4eae109a4258cd0cfb81

  • SHA256

    4d8344cc821d3077fd54ff3b6aa485cbdc13f746a21950a46dc944a80117028a

  • SHA512

    3cdfbff24eb0baf0be09ee67492042ee762998008aa4c9e4eba4b6e719ba5c85bcddc9f8125d13576073ca77e97e578429455362f9ff96b72f8fe92a6ff995ca

Malware Config

Extracted

Family

alienbot

C2

http://motorgamingbsa.site

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • csa.njapykfukfhq.dimwxgddzbpgjpwuxxzbhkn
    1⤵
    • Loads dropped Dex/Jar
    PID:6186
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6403
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7104

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/csa.njapykfukfhq.dimwxgddzbpgjpwuxxzbhkn/app_DynamicOptDex/ZOZc.json

        Filesize

        691KB

        MD5

        e7849cb913a9f880671264a109bab903

        SHA1

        1228487dabdef9363ccba3771a3ea9478c14aaf7

        SHA256

        e4dd217463d5c2dd8fdffc646bc148c9584c036be4be030b6268cc2ad22c4997

        SHA512

        83c75b2ba55bbd096d93cb79aaa06947a7c57b16711e06696c4bf04407742f56c4e9da9a7a3770c6818e7cc612d7a045bd53687ca05691ba79927c450888696f

      • /data/user/0/csa.njapykfukfhq.dimwxgddzbpgjpwuxxzbhkn/app_DynamicOptDex/ZOZc.json

        Filesize

        691KB

        MD5

        c6f3e44d370fb8d1051d1256944bba20

        SHA1

        8265ff933f81da414de42d0494b28c8df6dadb23

        SHA256

        a01335d0d1553740459d22138757dcb52c3c0d6f6963b2534c74c1ee407adbd2

        SHA512

        3d7328f7c3ef98d05d6b41ad1e482776e2dfa7e7f08c5ee615532624931b70f6518abeaf3df441a8e6106f99e36743867c257b92dcbb673e27298cf691d734b3

      • /data/user/0/csa.njapykfukfhq.dimwxgddzbpgjpwuxxzbhkn/app_DynamicOptDex/ZOZc.json

        Filesize

        691KB

        MD5

        c6f3e44d370fb8d1051d1256944bba20

        SHA1

        8265ff933f81da414de42d0494b28c8df6dadb23

        SHA256

        a01335d0d1553740459d22138757dcb52c3c0d6f6963b2534c74c1ee407adbd2

        SHA512

        3d7328f7c3ef98d05d6b41ad1e482776e2dfa7e7f08c5ee615532624931b70f6518abeaf3df441a8e6106f99e36743867c257b92dcbb673e27298cf691d734b3