Analysis

  • max time kernel
    3843832s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21/05/2022, 03:42

General

  • Target
    dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532.apk
  • Size 1.5MB
  • Sample220521-d9ssfshae9
  • SHA256 dafc457d7005b4cbdadf7c0060bc8350e83306a564dc279feb701e55d1c13532
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • alienbot

C2
  • http://odricatt.live

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • inmfdyqgouclkrfqty.uoenpnmz.qww
    1⤵
    • Loads dropped Dex/Jar
    PID:6219
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6358
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6450

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            DAQKO.json

            • Path /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json
            • Size 720KB
            • SHA256 30f0a5ceaae445b55d0a22b1be54fb3308729f812224f4c05317ee8a129e4891
            • MD5 SHA1 SHA512 SSDEEP

            DAQKO.json

            • Path /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json
            • Size 720KB
            • SHA256 dff426d0fce83ed7dbc85f1a304f0a84c93b2c5045390dd10a42710ce1d80e9b
            • MD5 SHA1 SHA512 SSDEEP

            DAQKO.json

            • Path /data/user/0/inmfdyqgouclkrfqty.uoenpnmz.qww/app_DynamicOptDex/DAQKO.json
            • Size 720KB
            • SHA256 dff426d0fce83ed7dbc85f1a304f0a84c93b2c5045390dd10a42710ce1d80e9b
            • MD5 SHA1 SHA512 SSDEEP