Analysis
-
max time kernel
3843862s -
max time network
162s -
platform
android_x64 -
resource
android-x64-20220310-en -
submitted
21-05-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a.apk
-
Size
1.9MB
-
MD5
ee64138f0b44fa9608ffdc180b5a6f5b
-
SHA1
70de78da20b72180198c64e0af01491f4aebeec4
-
SHA256
60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a
-
SHA512
925dd962ef93ce598f57f8849627e0142a17515b92dfd2a0f2817169fddd5132aac9af54a49f6ad870de31973993410b9daf0be72aef092dc8e76f67976a6211
Malware Config
Extracted
alienbot
http://installerflas7865432.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrqioc pid process /data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.json 6353 msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq /data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.json 6353 msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/oat/wQNd.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.jsonFilesize
733KB
MD596737c2cc290faf33442f5459252d256
SHA12257245684380c7aee5f3e16ed506cb4c6aa235b
SHA256c017c0bceb10cb0df99a10f1473985a39eac960745d2277f1e1ab003b0121a9f
SHA512124d378040294e5f280e45c4fbe334ecd99cca7fb26d10ed6d484def625da2c48eba6637af8d2eda8f0f847dfdad03bc3506501b670b7f9eb147c10b5268476e
-
/data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.jsonFilesize
733KB
MD572d251ab8a0bbfefcad58809eefb925d
SHA1b9749edcd83d9046d5660b3bbf7ae4ab06cabbd6
SHA256e43cd77d259541916a188c9174b7ab89ac17e4257ce3b923617f1f9d5d55bec4
SHA512509cc1456e9389553380ff1b8152fa2e17dbb6a898bc9a39c12ade8ce43cfe0aa4113c8542996bfe7395e4192262b727b745dc47778554f01535dab3332bee64
-
/data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.jsonFilesize
733KB
MD572d251ab8a0bbfefcad58809eefb925d
SHA1b9749edcd83d9046d5660b3bbf7ae4ab06cabbd6
SHA256e43cd77d259541916a188c9174b7ab89ac17e4257ce3b923617f1f9d5d55bec4
SHA512509cc1456e9389553380ff1b8152fa2e17dbb6a898bc9a39c12ade8ce43cfe0aa4113c8542996bfe7395e4192262b727b745dc47778554f01535dab3332bee64