Analysis

  • max time kernel
    3843477s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21/05/2022, 03:42

General

  • Target
    a4b7579bdb00a60461be39f8579e12c6b0f2c239547cedf9f18c5c6eccfbbce3.apk
  • Size 2.0MB
  • Sample220521-d9f4nahae2
  • SHA256 a4b7579bdb00a60461be39f8579e12c6b0f2c239547cedf9f18c5c6eccfbbce3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • alienbot

C2
  • http://ukalasey.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • izkedmghbqdztn.iinequq.xzic
    1⤵
    • Loads dropped Dex/Jar
    PID:6188
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6295
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6444

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GrgeQPO.json

            • Path /data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json
            • Size 703KB
            • SHA256 3aa437b266ee4c7cea62dee32fb1f6f6ee16bdf6d07c7c66edf274f98ff96fe4
            • MD5 SHA1 SHA512 SSDEEP

            GrgeQPO.json

            • Path /data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json
            • Size 703KB
            • SHA256 0780edaaadb40bb021f76f3007666e40d2c25f9c9bb4afad4fcb904e38d44da8
            • MD5 SHA1 SHA512 SSDEEP

            GrgeQPO.json

            • Path /data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json
            • Size 703KB
            • SHA256 0780edaaadb40bb021f76f3007666e40d2c25f9c9bb4afad4fcb904e38d44da8
            • MD5 SHA1 SHA512 SSDEEP