Analysis
- max time kernel
3871338s - max time network
163s - platform
android_x64 - resource
android-x64-20220310-en - submitted
21/05/2022, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
a79603d93209ed455d83694300afe91d62e1d6d80a52406ba02750872efaad56.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a79603d93209ed455d83694300afe91d62e1d6d80a52406ba02750872efaad56.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
a79603d93209ed455d83694300afe91d62e1d6d80a52406ba02750872efaad56.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target a79603d93209ed455d83694300afe91d62e1d6d80a52406ba02750872efaad56.apk
- Size 3.4MB
- Sample220521-pklhmafea2
- SHA256 a79603d93209ed455d83694300afe91d62e1d6d80a52406ba02750872efaad56
- MD5 3e324e61184e75c95ea2149ee9be0478
- SHA1 87b46e38d16c07b2625ebb3fe8ee4847c0119775
- SHA512 4880497b1249d024d77f022c4590c9b73b17c379592b1700ab88cce738434727337e651e0f3bffacc6c45394de76c498d495b660d2cc149c6b8cf4b5d816d390
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
alienbot
C2
-
http://fightfightgame.info
Signatures
- Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.wyaiqay/cache/payload.jar 6178 com.wyaiqay
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.wyaiqay/cache/payload.jar
- Size 237KB
- SHA256 2248f17f6f01488768d06607e594b22627fbd0ad3b736f30387229fce3686870
- MD5 d4624e7debb7623fb9caf6dc36edcdb0
- SHA1 daa003913f45d11944477b16184d2d38f22233be
- SHA512 6566b3cb93133dc53cfb4edbf6b6fde75fa5d2a5e0f2407f0d76054d6f4ed3283a456a29a8f6de8eed23f2a21dfe290aa674e6e2ec7d65eca0d71c5c39b707a8
- SSDEEP 6144:9UTlyY588TGOMY5lpnvltoU0kqrFHFKjgzsqwz1w4of710AsQ:6TlyYRz5lpdtohk2HFKhnoh+Q
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.wyaiqay/cache/payload.jar
- Size 474KB
- SHA256 40098869a91366d3714edf2933b64461ddb4b711b3681d341a02b740c31d173b
- MD5 445826e82c27ccefb5dd094ba4f0ddca
- SHA1 6a8ec9967f93d6ef107dc2687b1924bc0d5aafca
- SHA512 30d4977324103c9afe427133e6666f866c7f20f22163414f652f8aeaaa9d0253be54c92fb5250380c0c97e8437c004bdfd4513f454b49274463bfed76488fb0b
- SSDEEP 6144:50Xn2DxQ93xYnaej2cXF6H4Myvj3rSx5n1zn7/7+ETQwirXzBfl915R3J8RK:5+zx7W2cV6HOvjbIn1z77+T9D173Z
- MD5 SHA1 SHA512 SSDEEP