Analysis
- max time kernel
2745201s - max time network
159s - platform
android_x64 - resource
android-x64-20220310-en - submitted
08/05/2022, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
1e354556d19a1693dcfa71503f0ce9d6c64eb3a178c787bf3700734cdca0ec10.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1e354556d19a1693dcfa71503f0ce9d6c64eb3a178c787bf3700734cdca0ec10.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
1e354556d19a1693dcfa71503f0ce9d6c64eb3a178c787bf3700734cdca0ec10.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target 1e354556d19a1693dcfa71503f0ce9d6c64eb3a178c787bf3700734cdca0ec10.apk
- Size 1.4MB
- Sample220508-krss3agdgn
- SHA256 1e354556d19a1693dcfa71503f0ce9d6c64eb3a178c787bf3700734cdca0ec10
- MD5 e0d9fac23bd437acf627034167ca9ae5
- SHA1 b12bff0466b9a49bfde4dc893b23ee01867b9b9a
- SHA512 f0a8b7b6fca7408704715cc735c7612ba866f89b62f5660c73ff1816fb52674ee3380a91117ed11fde8f2b328acc51b0182734c2dd60de58c0004190d48d1ee1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
alienbot
C2
-
http://fxancc4fp4.site
Signatures
- Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/pkcoyusjaos.mlkpjczeyppt.pqtthnquh/app_DynamicOptDex/wYe.json 6275 pkcoyusjaos.mlkpjczeyppt.pqtthnquh /data/user/0/pkcoyusjaos.mlkpjczeyppt.pqtthnquh/app_DynamicOptDex/wYe.json 6275 pkcoyusjaos.mlkpjczeyppt.pqtthnquh
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/pkcoyusjaos.mlkpjczeyppt.pqtthnquh/app_DynamicOptDex/wYe.json
- Size 502KB
- SHA256 69679af648e6562b9243f4f2469e962844bb89979d1b2f7b44cde243f4ade47e
- MD5 702044b404aa643ff3dbeff3127fd4a5
- SHA1 1ea814333039b2c7c676fdbf9241c174ff1636c2
- SHA512 aebd9cfb68aa6007fcaa4717c4223b9b36331fe9edaea1aaa2116b793b84d1658cda5872bb9fe37e13ba78e19071d52caf5ec783e276ed519c8b257e39869e36
- SSDEEP 12288:1iTwXiwSMMkCiYVLYwrRJa7jHVQqPb77sV:ITfMxmYwNJanOqPbHsV
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/pkcoyusjaos.mlkpjczeyppt.pqtthnquh/app_DynamicOptDex/wYe.json
- Size 502KB
- SHA256 6a5b9e9b82d4929936e5ff51a88c296c5eb0f1ed0434be2217f9a5ffd442e14f
- MD5 138a2f7344e982776c47558ab3c89af3
- SHA1 8adf1290cd4b3baf6c6743c322c2f1457f5c26da
- SHA512 8652cdc245e6d3268738350c86c5df520f7e009829a605d49e22d313e2113b5415d802099933f562a0d0d7d32520820deb209d17226dc5705f0cf8eecff93d85
- SSDEEP 6144:+fNZ230s+Yzads/6Hu3vOoD3yhVHUtIGDmE+K/tj6SAOtt6K:+L23cYWU6H6v7DCPHaSENd8K
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/pkcoyusjaos.mlkpjczeyppt.pqtthnquh/app_DynamicOptDex/wYe.json
- Size 502KB
- SHA256 6a5b9e9b82d4929936e5ff51a88c296c5eb0f1ed0434be2217f9a5ffd442e14f
- MD5 138a2f7344e982776c47558ab3c89af3
- SHA1 8adf1290cd4b3baf6c6743c322c2f1457f5c26da
- SHA512 8652cdc245e6d3268738350c86c5df520f7e009829a605d49e22d313e2113b5415d802099933f562a0d0d7d32520820deb209d17226dc5705f0cf8eecff93d85
- SSDEEP 6144:+fNZ230s+Yzads/6Hu3vOoD3yhVHUtIGDmE+K/tj6SAOtt6K:+L23cYWU6H6v7DCPHaSENd8K
- MD5 SHA1 SHA512 SSDEEP