Analysis

  • max time kernel
    3843862s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21-05-2022 03:43

General

  • Target

    60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a.apk

  • Size

    1.9MB

  • MD5

    ee64138f0b44fa9608ffdc180b5a6f5b

  • SHA1

    70de78da20b72180198c64e0af01491f4aebeec4

  • SHA256

    60bd8249ebbf145ecf0d599add9ce8c94fcbab05d5af1332a27fdbe74264101a

  • SHA512

    925dd962ef93ce598f57f8849627e0142a17515b92dfd2a0f2817169fddd5132aac9af54a49f6ad870de31973993410b9daf0be72aef092dc8e76f67976a6211

Malware Config

Extracted

Family

alienbot

C2

http://installerflas7865432.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq
    1⤵
    • Loads dropped Dex/Jar
    PID:6353

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/oat/wQNd.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.json
    Filesize

    733KB

    MD5

    96737c2cc290faf33442f5459252d256

    SHA1

    2257245684380c7aee5f3e16ed506cb4c6aa235b

    SHA256

    c017c0bceb10cb0df99a10f1473985a39eac960745d2277f1e1ab003b0121a9f

    SHA512

    124d378040294e5f280e45c4fbe334ecd99cca7fb26d10ed6d484def625da2c48eba6637af8d2eda8f0f847dfdad03bc3506501b670b7f9eb147c10b5268476e

  • /data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.json
    Filesize

    733KB

    MD5

    72d251ab8a0bbfefcad58809eefb925d

    SHA1

    b9749edcd83d9046d5660b3bbf7ae4ab06cabbd6

    SHA256

    e43cd77d259541916a188c9174b7ab89ac17e4257ce3b923617f1f9d5d55bec4

    SHA512

    509cc1456e9389553380ff1b8152fa2e17dbb6a898bc9a39c12ade8ce43cfe0aa4113c8542996bfe7395e4192262b727b745dc47778554f01535dab3332bee64

  • /data/user/0/msicurhqkqwptbzu.huf.nalckaedtjorbiecockqrrq/app_DynamicOptDex/wQNd.json
    Filesize

    733KB

    MD5

    72d251ab8a0bbfefcad58809eefb925d

    SHA1

    b9749edcd83d9046d5660b3bbf7ae4ab06cabbd6

    SHA256

    e43cd77d259541916a188c9174b7ab89ac17e4257ce3b923617f1f9d5d55bec4

    SHA512

    509cc1456e9389553380ff1b8152fa2e17dbb6a898bc9a39c12ade8ce43cfe0aa4113c8542996bfe7395e4192262b727b745dc47778554f01535dab3332bee64