Analysis
-
max time kernel
4136711s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20220310-en -
submitted
24/05/2022, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629.apk
-
Size
1.4MB
-
MD5
499a6d546e1eb0642592e09a4f51b925
-
SHA1
4138c0d496121b887ee1917a467e0977cbe7c65b
-
SHA256
09035d83bfadc216ac5829672d46ecb4efacfc3fe69be2eacca4dceba807b629
-
SHA512
8b3ea67f235b2ba38d2a03739514845a02beda9274a53ae357ab8cb17d16289e07f0152c5301f0023697dc1c2ab3bcaad835b98cb073f43039bd2a201041260b
Malware Config
Extracted
alienbot
http://operolstels12.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json 6190 lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc /data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json 6190 lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json
Filesize662KB
MD564b51c616716d945ce7d032794a49436
SHA1293d3d8d195253799af2c058ac4fc8cf0cdf185b
SHA256342f91b5c6caa73524fbcd044c0793833922101e4b97270bacff002585388ad4
SHA512a2148f9b066ea8463af7b5aa9079eb26542d21ad978a8eccee1e5dffd2d62298f31b11521bc46dc2397e86176cb455db54d3851086fa6f1b1eec19046be6cf81
-
/data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json
Filesize662KB
MD5d7c9d4937fd2a88b7c3742950fd58a49
SHA1191d57d1a0bfb5661ad0c9bd9d4e3159155cc29d
SHA256a6b5a624cfca5bf21f33c0f23954a04e3f41482411914bcec394b3cb53e902ba
SHA512a313724e810fdd5e2a56a2cff568ceed7d74b8402b8b49e7deb70c92fbcef75642da54b18595b7487c7b558fa59e0a29506e8a2be9a765b7a00c56c836ac90dc
-
/data/user/0/lpspiwcapia.lgqcpgtiuowulrxuema.owbawpcfdaujuhrrmhomdxdjxrc/app_DynamicOptDex/kdYKJUu.json
Filesize662KB
MD5d7c9d4937fd2a88b7c3742950fd58a49
SHA1191d57d1a0bfb5661ad0c9bd9d4e3159155cc29d
SHA256a6b5a624cfca5bf21f33c0f23954a04e3f41482411914bcec394b3cb53e902ba
SHA512a313724e810fdd5e2a56a2cff568ceed7d74b8402b8b49e7deb70c92fbcef75642da54b18595b7487c7b558fa59e0a29506e8a2be9a765b7a00c56c836ac90dc