Analysis

  • max time kernel
    3843510s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21/05/2022, 03:42

General

  • Target

    e360bca3a85903e9aac73ca461ba5c70a03ed0f394597248807e9f1cabc6a26c.apk

  • Size

    2.2MB

  • MD5

    46bee1617acc6208cce3b2b5c6eb57f8

  • SHA1

    411a4ab57094f3dda939dcd7178192608ac5966b

  • SHA256

    e360bca3a85903e9aac73ca461ba5c70a03ed0f394597248807e9f1cabc6a26c

  • SHA512

    7252847ee15e5702785e791943c7a2dc4b946b8c4df9570e41309d4a97fcd205ba5571ce9a35d43c5b577da58778834fa877824057cbca1ff0460abe97f2a3e2

Malware Config

Extracted

Family

alienbot

C2

http://akarbvc11.site

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • lojwzbcakygecylajzqphloch.uhxglitskldhggh.nicknzb
    1⤵
    • Loads dropped Dex/Jar
    PID:6347
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6445
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6533

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/lojwzbcakygecylajzqphloch.uhxglitskldhggh.nicknzb/app_DynamicOptDex/EEI.json

        Filesize

        719KB

        MD5

        3ab582540d402d67ba3fff5f5082dab6

        SHA1

        9418e3da350f97efa39b292b6fcaa4a9bc64d371

        SHA256

        ea8ecfc886c8d227f72244ae4a5194de75002a16f37ef4f87d9b14f30e3ebcc6

        SHA512

        8e4a38935f87880bff9d54826c585ed11583a3a3a128599f5f9b3d8560c800308b76128c4d31c5eb5cfe5b45625a89a6386f33ff8cc509add77ee7afd5fd6f30

      • /data/user/0/lojwzbcakygecylajzqphloch.uhxglitskldhggh.nicknzb/app_DynamicOptDex/EEI.json

        Filesize

        719KB

        MD5

        701cbf64b3029830a39573f2025345fb

        SHA1

        820d413e90ad9ebeaeddc83f23d9774d7c735ef7

        SHA256

        6e2a515db7e94308c02508a87315017a768f108449984a63ab8b919e3682956d

        SHA512

        e2cb92f8e865d9b345febc6280658edc42fc05396b7a12091bbc5c3eab58ab101422503f76b3cbb762855f1e4b41acfe1cfde527982af7a87333737a3f6bf4fe

      • /data/user/0/lojwzbcakygecylajzqphloch.uhxglitskldhggh.nicknzb/app_DynamicOptDex/EEI.json

        Filesize

        719KB

        MD5

        701cbf64b3029830a39573f2025345fb

        SHA1

        820d413e90ad9ebeaeddc83f23d9774d7c735ef7

        SHA256

        6e2a515db7e94308c02508a87315017a768f108449984a63ab8b919e3682956d

        SHA512

        e2cb92f8e865d9b345febc6280658edc42fc05396b7a12091bbc5c3eab58ab101422503f76b3cbb762855f1e4b41acfe1cfde527982af7a87333737a3f6bf4fe