Overview

overview

10

Static

static

7

559fc04862...b2.apk

android_x86

10

559fc04862...b2.apk

android_x64

10

559fc04862...b2.apk

android_x64

10

Analysis

  • max time kernel
    3871184s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    21/05/2022, 12:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    559fc04862c2cceac7adeb41328971978dd9b34a69f77bc1f2a7b56577e58bb2.apk

  • Size

    2.0MB

  • MD5

    3b8ae394a9cca08c46e8b5acc6586a00

  • SHA1

    e7aa1d821937d722574432410fb235fccba22965

  • SHA256

    559fc04862c2cceac7adeb41328971978dd9b34a69f77bc1f2a7b56577e58bb2

  • SHA512

    1a5f632cab2283e3d076cb882c25ae37c004e95e8ec81dd159f20ea872968d273dd95378ad823aa457f8a58f626eaed691c92a2c216e8f804f64cfe5d7491fd2

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://scenteadid.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:6655
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6836
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6968
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7022
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7074
            • getprop ro.miui.ui.version.name
              2⤵
                PID:7123
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:7166
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:7210

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json
                  Filesize

                  683KB

                  MD5

                  e6a735de937330a6d9677b48c6ec2d0d

                  SHA1

                  2a192502ea568691a7f52366d85f4e905dc97210

                  SHA256

                  ab4d1548deebdf25fc2acd67814289cd7b37bff4201b4803a686cf5c0aa06652

                  SHA512

                  a7cf4a0d4d2a44a0986a72b6c0c82c323b24190ad988bc08e6da9b3a629125a4d0283589a9e5aa4528a89f832bb76728b56d47342977a37d5fed706c921f0412

                  Download Submit

                • /data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json
                  Filesize

                  683KB

                  MD5

                  7b83ad1f5e7f40d94f2a227f29ae4e2b

                  SHA1

                  91d3b791dcf6b3e2906bc3f2037fb02fbdc95008

                  SHA256

                  57be37d122fc62d820075ed64d75a732a64260783882d221321c54f10276543c

                  SHA512

                  a388a399474611c79d2a672587586a6ea2aebe14a49c786a3a3a052c7ad3a5566cb7a45da0b9f9ce8b795daef175a1cfdc6ff5498c4e9e95c87cc74233a14687

                  Download Submit

                • /data/user/0/kxx.zgmwmcoyucqqkgzskjasudfzxd.rmnkbzcbs/app_DynamicOptDex/YmtXQl.json
                  Filesize

                  683KB

                  MD5

                  7b83ad1f5e7f40d94f2a227f29ae4e2b

                  SHA1

                  91d3b791dcf6b3e2906bc3f2037fb02fbdc95008

                  SHA256

                  57be37d122fc62d820075ed64d75a732a64260783882d221321c54f10276543c

                  SHA512

                  a388a399474611c79d2a672587586a6ea2aebe14a49c786a3a3a052c7ad3a5566cb7a45da0b9f9ce8b795daef175a1cfdc6ff5498c4e9e95c87cc74233a14687

                  Download Submit