Overview

overview

10

Static

static

7

b5d89da7e2...3d.apk

android_x86

10

b5d89da7e2...3d.apk

android_x64

10

b5d89da7e2...3d.apk

android_x64

10

Analysis

  • max time kernel
    3844017s
  • max time network
    171s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    21/05/2022, 03:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b5d89da7e293d672cf0f25a0dd6f648198fd87ec38d4c6e3dddbfd1ed476353d.apk

  • Size

    1.8MB

  • MD5

    901e5f8fad8eebb16b2fef94d374e28c

  • SHA1

    95ceb552c963f8f77dbc0141b263e1fff513b6ef

  • SHA256

    b5d89da7e293d672cf0f25a0dd6f648198fd87ec38d4c6e3dddbfd1ed476353d

  • SHA512

    3bce831f56d35a23f4fa6abf928413c0b3608661e3eba3e92db092b3c60b50d9509aa61754e89d07e2c0660b270d3ac67f324df1de5490da627e135bb4c954d0

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://akinbilisimv.org

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • ysuurfcslzhitqytarnmm.agekck.hsaxpa
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:6944
    • getprop ro.miui.ui.version.name
      2⤵
        PID:7048
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7154
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7216
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7261
            • getprop ro.miui.ui.version.name
              2⤵
                PID:7297
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:7328
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:7382

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/ysuurfcslzhitqytarnmm.agekck.hsaxpa/app_DynamicOptDex/gYh.json
                  Filesize

                  761KB

                  MD5

                  617047e2250d840013b5041b0d6de288

                  SHA1

                  8b83d568a3dcc0bc9901db0c6ca9da46ef44b350

                  SHA256

                  c8db58c5a4576c7ea21e69f90bb174c5cd824c99d9c323d42a161129960eef8b

                  SHA512

                  8b14fbc7c0cbcae4a249f129026dd5657e71942a874f8a24296ec096ce284787da3f6b394a1a0b25bc727eebd561db401263ed1543e791c90673774db7af21fa

                  Download Submit

                • /data/user/0/ysuurfcslzhitqytarnmm.agekck.hsaxpa/app_DynamicOptDex/gYh.json
                  Filesize

                  761KB

                  MD5

                  fab1346de96031542c420da7c8e82fe1

                  SHA1

                  02cbc0c99ae702659bb48b14ff387991d1cab347

                  SHA256

                  9878614ef33e75addb79476e35a84d2af4ce39e19063cd36fafa3735783852ce

                  SHA512

                  828947efc00d57a23abc891a0e3a369358ed73fcc52efc30ce5db026fc995c86c1f31a45fc1b4f308af076ed345d554f53a6ec89c74d5d10c98bfc64f5813682

                  Download Submit

                • /data/user/0/ysuurfcslzhitqytarnmm.agekck.hsaxpa/app_DynamicOptDex/gYh.json
                  Filesize

                  761KB

                  MD5

                  fab1346de96031542c420da7c8e82fe1

                  SHA1

                  02cbc0c99ae702659bb48b14ff387991d1cab347

                  SHA256

                  9878614ef33e75addb79476e35a84d2af4ce39e19063cd36fafa3735783852ce

                  SHA512

                  828947efc00d57a23abc891a0e3a369358ed73fcc52efc30ce5db026fc995c86c1f31a45fc1b4f308af076ed345d554f53a6ec89c74d5d10c98bfc64f5813682

                  Download Submit