Analysis
-
max time kernel
4148252s -
max time network
143s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
24-05-2022 16:30
Static task
static1
Behavioral task
behavioral1
Sample
a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe.apk
-
Size
1.9MB
-
MD5
9bfad241f185c8272b956b4a9d51d095
-
SHA1
4e29c2077315fe9dbc2f8557f7234cdd9a218358
-
SHA256
a11ec71c53dadc6d60452151a495c998ed01ae6720961ff574ddd67106b215fe
-
SHA512
a5dfdf69d8a534335874dc716f66dc20004562e7bc5b91687691e589bd034bce73279ecd6251a9ea6a6ec762d2876ef16bcbd1dc334a44e7bb64634eed9531e5
Malware Config
Extracted
alienbot
http://dashatrevelergod.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId uhwhzyxmbioxp.ytr.dbam Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId uhwhzyxmbioxp.ytr.dbam -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json 5042 uhwhzyxmbioxp.ytr.dbam /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json 5086 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/oat/x86/sJsLIx.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json 5042 uhwhzyxmbioxp.ytr.dbam -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag uhwhzyxmbioxp.ytr.dbam
Processes
-
uhwhzyxmbioxp.ytr.dbam1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5042 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/sJsLIx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/uhwhzyxmbioxp.ytr.dbam/app_DynamicOptDex/oat/x86/sJsLIx.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:5086
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645KB
MD528ca8d49608149cc64e5f50406890f64
SHA15df9c8fca0b1fd768eb5cd4bd1e4ff6c9b6f72ff
SHA25601eb3208412833493a8a5e76aee8cf7b5a1fa705433ac9eaf1e9fe9286991e80
SHA5129bffc42ec30719a626d504bb1af88f8c1f02cfd314bfe092f1ddcb9dc53120bd92574c4ad1085308cbcbe54838b4cf81ecbf4b7a0af4c8ccd43de1f20c70fd17
-
Filesize
645KB
MD558660ee5448ef8dbeead943ce3dbeb41
SHA1f1f99d02aa907d9708cff8207a5872521d5370d4
SHA256fa38c22e6aa6e749e732fc970460fff4b7c9cfc2f87afe0b05ee3ad85ca1bd5e
SHA512572519e6a2590088cc695c1e604ebaac29643a723e219067d49d202ce20d63aef811123e5743266b05ae2afd7cd8cd2c3667fb4f539207b41078891d081b39a0
-
Filesize
645KB
MD500e3386792ac365205e6f441ab1696b3
SHA193535e73987c66baa49a07b40bde8a5becc4c386
SHA2562a58bea361fe80d69cd348ef8229d7af721404c33d89eed9001c9d26c061c0c7
SHA512c8108d920623d4bce5a3235482c4d70e5f285c42be5c7a4404a7906f27b4a4746f1c526a72160b8f95ba0242096649783f23620400ec64475ad59d59ef071803
-
Filesize
645KB
MD558660ee5448ef8dbeead943ce3dbeb41
SHA1f1f99d02aa907d9708cff8207a5872521d5370d4
SHA256fa38c22e6aa6e749e732fc970460fff4b7c9cfc2f87afe0b05ee3ad85ca1bd5e
SHA512572519e6a2590088cc695c1e604ebaac29643a723e219067d49d202ce20d63aef811123e5743266b05ae2afd7cd8cd2c3667fb4f539207b41078891d081b39a0
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD500cde99767f1178c2778562640687edb
SHA1794656dc0a5e5dd28ed327c43a4a96055ac08014
SHA2562582014c61dffafbdb1c5fadccb233a9f38ccf3cad9271296683ad36391412db
SHA51234c45de68645560c87b40b6f0296272e00a4af8cb0cd6f523612da0f1a2b8766b75256ed05168ff34f350abc8e69f33e19cefbdda7d114394a6ce6fbecb04731
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD5c08d98e078da5c9f7f48bcb3f684cb03
SHA1987ab4a29fa03f9471ec36829a896f77a9130ccf
SHA256b993ef7d4b9838460e6e4fc9ddc8975f5131aa89787c31c1972b52b04088acea
SHA512fae11e0adb1861a58c017bc7a7f1303fac3a04ae022d1f8702b4b51405c09783925f93e4190c0df2b6817adaf662db8929c11252353a48eb1e96e2db7a70d906
-
Filesize
36B
MD5d00b7a03dcecab79c2cdb46e0ceac7a0
SHA1a0810f4833242501551de3026073055cf5826d96
SHA256a8dfe7f1148fc38e4bbbb045305b60cf09b94e4ae34944011aa9bee2b4eb16ce
SHA51224b4924055a34a8be58d68c31f270d2af81e6aac8fd5ce66fc6a0e5cd486da601f41a10caaaa9c0a47e0e842be9f486d35b923f36e162a561088e4a5ea3f68b8
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48