Analysis

  • max time kernel
    4148252s
  • max time network
    143s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    24-05-2022 16:30

General

  • Target

    a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe.apk

  • Size

    1.9MB

  • MD5

    9bfad241f185c8272b956b4a9d51d095

  • SHA1

    4e29c2077315fe9dbc2f8557f7234cdd9a218358

  • SHA256

    a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe

  • SHA512

    a5dfdf69d8a534335874dc716f66dc20004562e7bc5b91687691e589bd034bce73279ecd6251a9ea6a6ec762d2876ef16bcbd1dc334a44e7bb64634eed9531e5

Malware Config

Extracted

Family

alienbot

C2

http://dashatrevelergod.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Removes a system notification. 1 IoCs

Processes

  • uhwhzyxmbioxp.ytr.dbam
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:5042
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/oat/x86/sJsLIx.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5086

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json

    Filesize

    645KB

    MD5

    28ca8d49608149cc64e5f50406890f64

    SHA1

    5df9c8fca0b1fd768eb5cd4bd1e4ff6c9b6f72ff

    SHA256

    01eb3208412833493a8a5e76aee8cf7b5a1fa705433ac9eaf1e9fe9286991e80

    SHA512

    9bffc42ec30719a626d504bb1af88f8c1f02cfd314bfe092f1ddcb9dc53120bd92574c4ad1085308cbcbe54838b4cf81ecbf4b7a0af4c8ccd43de1f20c70fd17

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json

    Filesize

    645KB

    MD5

    58660ee5448ef8dbeead943ce3dbeb41

    SHA1

    f1f99d02aa907d9708cff8207a5872521d5370d4

    SHA256

    fa38c22e6aa6e749e732fc970460fff4b7c9cfc2f87afe0b05ee3ad85ca1bd5e

    SHA512

    572519e6a2590088cc695c1e604ebaac29643a723e219067d49d202ce20d63aef811123e5743266b05ae2afd7cd8cd2c3667fb4f539207b41078891d081b39a0

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json

    Filesize

    645KB

    MD5

    00e3386792ac365205e6f441ab1696b3

    SHA1

    93535e73987c66baa49a07b40bde8a5becc4c386

    SHA256

    2a58bea361fe80d69cd348ef8229d7af721404c33d89eed9001c9d26c061c0c7

    SHA512

    c8108d920623d4bce5a3235482c4d70e5f285c42be5c7a4404a7906f27b4a4746f1c526a72160b8f95ba0242096649783f23620400ec64475ad59d59ef071803

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json

    Filesize

    645KB

    MD5

    58660ee5448ef8dbeead943ce3dbeb41

    SHA1

    f1f99d02aa907d9708cff8207a5872521d5370d4

    SHA256

    fa38c22e6aa6e749e732fc970460fff4b7c9cfc2f87afe0b05ee3ad85ca1bd5e

    SHA512

    572519e6a2590088cc695c1e604ebaac29643a723e219067d49d202ce20d63aef811123e5743266b05ae2afd7cd8cd2c3667fb4f539207b41078891d081b39a0

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_webview/GPUCache/index

    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_webview/GPUCache/index-dir/temp-index

    Filesize

    48B

    MD5

    00cde99767f1178c2778562640687edb

    SHA1

    794656dc0a5e5dd28ed327c43a4a96055ac08014

    SHA256

    2582014c61dffafbdb1c5fadccb233a9f38ccf3cad9271296683ad36391412db

    SHA512

    34c45de68645560c87b40b6f0296272e00a4af8cb0cd6f523612da0f1a2b8766b75256ed05168ff34f350abc8e69f33e19cefbdda7d114394a6ce6fbecb04731

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_webview/Web Data

    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_webview/Web Data-journal

    Filesize

    1KB

    MD5

    c08d98e078da5c9f7f48bcb3f684cb03

    SHA1

    987ab4a29fa03f9471ec36829a896f77a9130ccf

    SHA256

    b993ef7d4b9838460e6e4fc9ddc8975f5131aa89787c31c1972b52b04088acea

    SHA512

    fae11e0adb1861a58c017bc7a7f1303fac3a04ae022d1f8702b4b51405c09783925f93e4190c0df2b6817adaf662db8929c11252353a48eb1e96e2db7a70d906

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_webview/metrics_guid

    Filesize

    36B

    MD5

    d00b7a03dcecab79c2cdb46e0ceac7a0

    SHA1

    a0810f4833242501551de3026073055cf5826d96

    SHA256

    a8dfe7f1148fc38e4bbbb045305b60cf09b94e4ae34944011aa9bee2b4eb16ce

    SHA512

    24b4924055a34a8be58d68c31f270d2af81e6aac8fd5ce66fc6a0e5cd486da601f41a10caaaa9c0a47e0e842be9f486d35b923f36e162a561088e4a5ea3f68b8

  • /data/user/0/uhwhzyxmbioxp.ytr.dbam/shared_prefs/WebViewChromiumPrefs.xml

    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48