Analysis

  • max time kernel
    3763111s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    20/05/2022, 06:14

General

  • Target

    4a7adde4bea53ce1adf56e119f8a28d3c135ab265f20d5b53fe54c728999da24.apk

  • Size

    1.7MB

  • MD5

    ec8896a5a8041cedf5479bab6a8601bf

  • SHA1

    e97e32d1cbc26c13f708c13f0d61a0b6b50384c2

  • SHA256

    4a7adde4bea53ce1adf56e119f8a28d3c135ab265f20d5b53fe54c728999da24

  • SHA512

    9fe6a8f2caf14a646b97cd23e19b84fefbd2cc2b15b3c665adffcf733927c424b718b5bbcd255ce070e476f6d3b9e0dede7749211e2d20e85c5dfb9986e13537

Malware Config

Extracted

Family

alienbot

C2

http://fillimillidilli.top

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • eucgw.eiqcaxglyqyltpng.pioglmzyha
    1⤵
    • Loads dropped Dex/Jar
    PID:6221
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6369
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6464

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/eucgw.eiqcaxglyqyltpng.pioglmzyha/app_DynamicOptDex/uhic.json

        Filesize

        681KB

        MD5

        cbbf1ecde18bf41a6e42b85ee46d1c6d

        SHA1

        44f4cd42a909f3191668c827e6b035b6d759b061

        SHA256

        f73d775bc5546fc4ca0f07edbceec423fb9a49735a21404c95b57763fdd71048

        SHA512

        e85d096a93936197ea6d341af063a1ef508877f9085f94fa471f9e1d5aebc538fad1c2b31429e5b7c989cba68f9148e1f317e31e0eedec1f85edcfc2ea3627e0

      • /data/user/0/eucgw.eiqcaxglyqyltpng.pioglmzyha/app_DynamicOptDex/uhic.json

        Filesize

        681KB

        MD5

        20579b2bd0846b9a6b42cfd2b9a390df

        SHA1

        4a84a4e17979b246ed8d9127cead13fa6010e8ab

        SHA256

        56a8282a0b2198a20f7421ef3566ee5cd063e6509e7e07829deaa5db5b72687e

        SHA512

        880c84a2ca972d94e52331967cd048a39d0562acff3e2bf71ef186e5e2ed028819b89756df54da3eac14d78367c3a3c10ac427b5d6b701a34a88006c61b822f6

      • /data/user/0/eucgw.eiqcaxglyqyltpng.pioglmzyha/app_DynamicOptDex/uhic.json

        Filesize

        681KB

        MD5

        20579b2bd0846b9a6b42cfd2b9a390df

        SHA1

        4a84a4e17979b246ed8d9127cead13fa6010e8ab

        SHA256

        56a8282a0b2198a20f7421ef3566ee5cd063e6509e7e07829deaa5db5b72687e

        SHA512

        880c84a2ca972d94e52331967cd048a39d0562acff3e2bf71ef186e5e2ed028819b89756df54da3eac14d78367c3a3c10ac427b5d6b701a34a88006c61b822f6