Analysis

  • max time kernel
    3844217s
  • max time network
    164s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21-05-2022 03:43

General

  • Target

    34d686218a7a221d44299d62145d7641f71b8a17321b50cb3884e19f66c04126.apk

  • Size

    1.5MB

  • MD5

    d8047be7c6a084f2bc08c346073dd8d8

  • SHA1

    0aac337499f8283e7e8d37d9532a2cd5c1422719

  • SHA256

    34d686218a7a221d44299d62145d7641f71b8a17321b50cb3884e19f66c04126

  • SHA512

    0ee5001b1bb84dc97c767bc7e94c30d75436ec772e92bf9f74b4194eeb5d48e0237de593061dfaa07f0d39e1ef2aefc52393d48310e4b952f1ec85e94a6d7fb5

Malware Config

Extracted

Family

alienbot

C2

http://elondauned.xyz/

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd
    1⤵
    • Loads dropped Dex/Jar
    PID:6174
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6296
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7045

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

        Filesize

        731KB

        MD5

        c3c233c39aaea59ad7bc203d31c3bfb6

        SHA1

        9b35fa18b01ac6820239b2872ca0c3f6a5272314

        SHA256

        3f0a83f006aeca52e60a1b0746a1d857ca25f316605237d8bee023375c4852eb

        SHA512

        d46b30bf1dff9e4ec359c03c98f9ba5414ca14d7110caaeffae86565f08e06337207d83819015a8dbba4a51adaaf005b08534fc4630d0475050cf207aa314b9a

      • /data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

        Filesize

        731KB

        MD5

        169f416fee37927b4c408151ba37e61b

        SHA1

        8f466c3cf5ab73f2bd3ab477bd69c36304b2cb10

        SHA256

        05b412cdbf39324ac2374cf590ce3ebb1efec1a787d5a25fa718f3fc8ad7d0fa

        SHA512

        2aa7e4d6abaf5106be431e58f987f723af474864988255d9dd670d858b678048da74599008996cfdf23d0be13bd34adbf43464de4a2991143b9f0d5f2d7675e4

      • /data/user/0/eyoqthxfmyj.nnnboiyzffqjarpg.hcirtaxqskrd/app_DynamicOptDex/Mb.json

        Filesize

        731KB

        MD5

        169f416fee37927b4c408151ba37e61b

        SHA1

        8f466c3cf5ab73f2bd3ab477bd69c36304b2cb10

        SHA256

        05b412cdbf39324ac2374cf590ce3ebb1efec1a787d5a25fa718f3fc8ad7d0fa

        SHA512

        2aa7e4d6abaf5106be431e58f987f723af474864988255d9dd670d858b678048da74599008996cfdf23d0be13bd34adbf43464de4a2991143b9f0d5f2d7675e4