Analysis

  • max time kernel
    4136711s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    24/05/2022, 14:18

General

  • Target

    09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629.apk

  • Size

    1.4MB

  • MD5

    499a6d546e1eb0642592e09a4f51b925

  • SHA1

    4138c0d496121b887ee1917a467e0977cbe7c65b

  • SHA256

    09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629

  • SHA512

    8b3ea67f235b2ba38d2a03739514845a02beda9274a53ae357ab8cb17d16289e07f0152c5301f0023697dc1c2ab3bcaad835b98cb073f43039bd2a201041260b

Malware Config

Extracted

Family

alienbot

C2

http://operolstels12.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc
    1⤵
    • Loads dropped Dex/Jar
    PID:6190
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6297
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6447

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json

        Filesize

        662KB

        MD5

        64b51c616716d945ce7d032794a49436

        SHA1

        293d3d8d195253799af2c058ac4fc8cf0cdf185b

        SHA256

        342f91b5c6caa73524fbcd044c0793833922101e4b97270bacff002585388ad4

        SHA512

        a2148f9b066ea8463af7b5aa9079eb26542d21ad978a8eccee1e5dffd2d62298f31b11521bc46dc2397e86176cb455db54d3851086fa6f1b1eec19046be6cf81

      • /data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json

        Filesize

        662KB

        MD5

        d7c9d4937fd2a88b7c3742950fd58a49

        SHA1

        191d57d1a0bfb5661ad0c9bd9d4e3159155cc29d

        SHA256

        a6b5a624cfca5bf21f33c0f23954a04e3f41482411914bcec394b3cb53e902ba

        SHA512

        a313724e810fdd5e2a56a2cff568ceed7d74b8402b8b49e7deb70c92fbcef75642da54b18595b7487c7b558fa59e0a29506e8a2be9a765b7a00c56c836ac90dc

      • /data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json

        Filesize

        662KB

        MD5

        d7c9d4937fd2a88b7c3742950fd58a49

        SHA1

        191d57d1a0bfb5661ad0c9bd9d4e3159155cc29d

        SHA256

        a6b5a624cfca5bf21f33c0f23954a04e3f41482411914bcec394b3cb53e902ba

        SHA512

        a313724e810fdd5e2a56a2cff568ceed7d74b8402b8b49e7deb70c92fbcef75642da54b18595b7487c7b558fa59e0a29506e8a2be9a765b7a00c56c836ac90dc