Analysis
- max time kernel
3843832s - max time network
160s - platform
android_x64 - resource
android-x64-20220310-en - submitted
21/05/2022, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532.apk
- Size 1.5MB
- Sample220521-d9ssfshae9
- SHA256 dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532
- MD5 8ca18d9c60d1bf540877f99b3569943f
- SHA1 ad201003c45f45147a3745100b47ef4acf3ce8c6
- SHA512 5d8469559f1eea724a5d703fa49e5e2059653e52c8b7ebe91c6fac3c1cc8421379b5db5812ae78377b6ad8f3e9ab6ba018f3a7724f2fb4019a66d9b1c57e51ff
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
alienbot
C2
-
http://odricatt.live
Signatures
- Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json 6219 inmfdyqgouclkrfqty.uoenpnmz.qww /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json 6219 inmfdyqgouclkrfqty.uoenpnmz.qww
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json
- Size 720KB
- SHA256 30f0a5ceaae445b55d0a22b1be54fb3308729f812224f4c05317ee8a129e4891
- MD5 cc7e7cad148aa82b53de28d65dd6570a
- SHA1 88c82b0ea3e5d8448b960e99f40ec9dd9c0db82f
- SHA512 daa16cc68bd3489ac85fb008a34876bd2e4a531321f47db42d902c3198f720f659b7aad1cf28dcfe41ab2697be2967dabbe9963c74a80550eea8e1ea3a3cc64e
- SSDEEP 12288:KMppEBfbn7SZPciimYQXqWRE4P2IXwh9qDVbDKABdwUbdqmnmlbx7opD2oyJjhb8:KMpGr7StN8QzRE4P2Ig+xDBUWqOmlFOp
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json
- Size 720KB
- SHA256 dff426d0fce83ed7dbc85f1a304f0a84c93b2c5045390dd10a42710ce1d80e9b
- MD5 c8c7377c2e956d6bfc465252fc6c106e
- SHA1 1f9e92c9e44442c4f0eb6d1753af754fc9904d87
- SHA512 ee281e74dd6dc69fcf2c2f31bc2fa1ea24f491e2764dcc5924202d7eee877bd914838427820a1506730450bed96000f855468d9d5aa3704922fcece33e28778e
- SSDEEP 12288:AfgP0EFzoK6H9v06YWRKPHf5RH+jkHr4rboLSsE+u8nSJ1b:XP0n8KRWHrejk0rboesznSn
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json
- Size 720KB
- SHA256 dff426d0fce83ed7dbc85f1a304f0a84c93b2c5045390dd10a42710ce1d80e9b
- MD5 c8c7377c2e956d6bfc465252fc6c106e
- SHA1 1f9e92c9e44442c4f0eb6d1753af754fc9904d87
- SHA512 ee281e74dd6dc69fcf2c2f31bc2fa1ea24f491e2764dcc5924202d7eee877bd914838427820a1506730450bed96000f855468d9d5aa3704922fcece33e28778e
- SSDEEP 12288:AfgP0EFzoK6H9v06YWRKPHf5RH+jkHr4rboLSsE+u8nSJ1b:XP0n8KRWHrejk0rboesznSn
- MD5 SHA1 SHA512 SSDEEP