Analysis

  • max time kernel
    3844341s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    21/05/2022, 03:43

General

  • Target

    b5e190ccd6458c193ac2eb2bd24d2f03a09a008d2bd4f8d5f368b6b4136554dd.apk

  • Size

    1.8MB

  • MD5

    dfd5e3854a0352e98bf31a8679879086

  • SHA1

    27486a5cda8183776e4031e9582e048b357deb0f

  • SHA256

    b5e190ccd6458c193ac2eb2bd24d2f03a09a008d2bd4f8d5f368b6b4136554dd

  • SHA512

    3453dbdc131540095f6a473fa03f55844807496cad099d56279ab67a7d44b4588d11ed9c39a32beedc827bcd8a85d4da442f8ed8d78eeb3dc6aac73b73069abb

Malware Config

Extracted

Family

alienbot

C2

http://installerflas678352.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • klzelitmcrkpg.whzhoytggkhohzdwhbucly.nebhlgldbgaui
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:6279
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6527
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6628
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7431
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7528
            • getprop ro.miui.ui.version.name
              2⤵
                PID:7567
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:7606
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:7636

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/klzelitmcrkpg.whzhoytggkhohzdwhbucly.nebhlgldbgaui/app_DynamicOptDex/aXKZ.json

                  Filesize

                  676KB

                  MD5

                  1d7ae5f244211c439c36f310ef2dbaac

                  SHA1

                  44bd3746148d784ca0319ce7deab7c2eae03c76a

                  SHA256

                  700e8c6590d3b52c57fac4b8bfc69c1cf0958cd14b146de7e5c1624236f58ffd

                  SHA512

                  3f75ff24d7bc19bd32479e0a25f7fcbb269a50d7b9ccecbbda500b62e0e8953a02fdcf487d5e07892b66111576698805ba1f02cd3c645cdf00b189ceeae8209a

                • /data/user/0/klzelitmcrkpg.whzhoytggkhohzdwhbucly.nebhlgldbgaui/app_DynamicOptDex/aXKZ.json

                  Filesize

                  676KB

                  MD5

                  47eff230e673054760a105c937745363

                  SHA1

                  82e5dcd903bdb786edf751000fc994bf2f9e1e00

                  SHA256

                  8a86d2f248f078bf42d69fde47d7462ebe071a46231028427edb4026a4dd250b

                  SHA512

                  c6ef36f142999770c2937e5e2395a40ac9d4004e757abf97a65e9d4aca81811276f6d4269deb8365a22be7e510b189e6098a14a2ff82734d5b0736b659daaa93

                • /data/user/0/klzelitmcrkpg.whzhoytggkhohzdwhbucly.nebhlgldbgaui/app_DynamicOptDex/aXKZ.json

                  Filesize

                  676KB

                  MD5

                  47eff230e673054760a105c937745363

                  SHA1

                  82e5dcd903bdb786edf751000fc994bf2f9e1e00

                  SHA256

                  8a86d2f248f078bf42d69fde47d7462ebe071a46231028427edb4026a4dd250b

                  SHA512

                  c6ef36f142999770c2937e5e2395a40ac9d4004e757abf97a65e9d4aca81811276f6d4269deb8365a22be7e510b189e6098a14a2ff82734d5b0736b659daaa93