Overview

overview

10

Static

static

7

f3d0965c2e...9e.apk

android_x86

10

f3d0965c2e...9e.apk

android_x64

7

f3d0965c2e...9e.apk

android_x64

10

Resubmissions

13-05-2022 20:54

220513-zp5r6sechm 10

10-05-2022 14:58

220510-sb53fscaek 10

Analysis

  • max time kernel
    3207988s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    13-05-2022 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3d0965c2e93b338a62ecdfa477ca380cad9e6105a51fef31567ae1a8d291e9e.apk

  • Size

    976KB

  • MD5

    a2077725a888217fffeec140a73325c2

  • SHA1

    f36abdfbd158c88f3661a6f6ee68dadddff4e1d7

  • SHA256

    f3d0965c2e93b338a62ecdfa477ca380cad9e6105a51fef31567ae1a8d291e9e

  • SHA512

    a070ef91ccc0aa58d85d2b126369bc1b8ff719c6b7f89c6e97fbe2238e6d20dcc512e057ebf09b4ed460cc7d29d48a5e5170e04424f3bedb8199d4a1d98cb308

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://lluxll.digital

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.valley.bamboo
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:6925
    • getprop ro.miui.ui.version.name
      2⤵
        PID:7072
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7180
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7225
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7284
            • getprop ro.miui.ui.version.name
              2⤵
                PID:7323
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:7352

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /data/user/0/com.valley.bamboo/app_DynamicOptDex/oat/yD.json.cur.prof
                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                Download Submit

              • /data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json
                Filesize

                238KB

                MD5

                f1009725383ca50b07f5f5ead1a85fd1

                SHA1

                bd82135b18706985419100f58076e7441f3db8b4

                SHA256

                411d5a109035c3530d162f005e1c475d6a1b764ca228d6a9af87079ca4c5b2af

                SHA512

                e77dc2dd34e31706d86ff6e7ecb4463d9390d641ea008fdf2166f8dd9bca444e0096d3af7bf9adb2e388ff211ecad738b00de2da77380146a7b23c4074f242cb

                Download Submit

              • /data/user/0/com.valley.bamboo/app_DynamicOptDex/yD.json
                Filesize

                483KB

                MD5

                f13b7d41aa8f192baa475216b94ad6a9

                SHA1

                bbb518ccec34528f39ea086d92f1af743d7e61e3

                SHA256

                191d4848a27cd708c8790c45d2f80cbaa798f5e8cef30cccf7f445b0b830c2fa

                SHA512

                9bc1f585e9efd7362deee30a921f5070a01d4efc793b5cc72911c457642bd5c49441ffa3deabdf11c61405b47a512d46ddd95b2a8b61ef367506a44d5c58b672

                Download Submit