Analysis

  • max time kernel
    3844041s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21/05/2022, 03:43

General

  • Target

    64845311c2e7ae9d027175b4b1443d9e039b97aeb1488785935dfe037ad884bd.apk

  • Size

    2.3MB

  • MD5

    fb9cfbcb8f613960e091d03f62e52078

  • SHA1

    8002498665d45758aa057bef17f91d23ca5d8df8

  • SHA256

    64845311c2e7ae9d027175b4b1443d9e039b97aeb1488785935dfe037ad884bd

  • SHA512

    aaa7365373909a1765f97bcc154db6d273085f44c61e46a487246d21d952c0d3f94dc5182becaedffb138c05918240a2aef5d9e202c74451e00255de5e72a97d

Malware Config

Extracted

Family

alienbot

C2

http://cxmarcellsat.top

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu
    1⤵
    • Loads dropped Dex/Jar
    PID:6382
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6465
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6551

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

        Filesize

        726KB

        MD5

        723dbe59e6ed87beec8e3b9c96c68e0a

        SHA1

        079fb9db6b9c7393918300a7afcc6cfca684ebe9

        SHA256

        efd9aaa0e4a79ca3f9293cde54d928e052031db7689614571bcfd169ed45eb3d

        SHA512

        dc3feedbbb9cf8305bb2eebfba96267203cd13556b570501d46f010e784a9a9385902fe8e20112587a81403d0b2672cacfc27ba79c11741c98036ef3b7d30458

      • /data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

        Filesize

        726KB

        MD5

        9d13bcce32673c487e2e0f18f99e7537

        SHA1

        166387b50ba791dceadffde3761b71a25a4ffc3a

        SHA256

        8dc68892fab2c7422413f3a313c198ca7e1f30a8ee8ad469b3a41ab39311798d

        SHA512

        89a900fc9946fe63ff117dfef8dda464ca6f86eb05f0c9a2dcc120623068de06b2475dd5630f6acce3ff30256ad9b7c0818119d9bef27554570b3287834ce000

      • /data/user/0/kwiejizn.zqxbkadrygwhfzfczh.kuxiqsedpsmgankftgmlozcbu/app_DynamicOptDex/uM.json

        Filesize

        726KB

        MD5

        9d13bcce32673c487e2e0f18f99e7537

        SHA1

        166387b50ba791dceadffde3761b71a25a4ffc3a

        SHA256

        8dc68892fab2c7422413f3a313c198ca7e1f30a8ee8ad469b3a41ab39311798d

        SHA512

        89a900fc9946fe63ff117dfef8dda464ca6f86eb05f0c9a2dcc120623068de06b2475dd5630f6acce3ff30256ad9b7c0818119d9bef27554570b3287834ce000