Overview

overview

10

Static

static

7

018c7cb705...b9.apk

android_x86

10

018c7cb705...b9.apk

android_x64

10

018c7cb705...b9.apk

android_x64

10

Analysis

  • max time kernel
    469374s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    31-05-2022 21:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    018c7cb70595ddf5fada24d8ca226d1e8efd2738300087c13189a60c311de8b9.apk

  • Size

    1.1MB

  • MD5

    5fc6b6e3e3489e9820b6a8d5d11f57e0

  • SHA1

    9b1e3231529e9b4d92682342901fe036ffdca928

  • SHA256

    018c7cb70595ddf5fada24d8ca226d1e8efd2738300087c13189a60c311de8b9

  • SHA512

    c5fc59c24bfd783dcf1252447346108d3305d98535b233691845382b69ffa9226a21120a2b50cc5ebd46b58b507e721e1bc3cc74cddbdc4a028a0e9b43127bc5

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://nnnxxceolmaz.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.library.hollow
    1⤵
    • Loads dropped Dex/Jar
    PID:6183
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6267
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6437
        • getprop ro.miui.ui.version.name
          2⤵
            PID:6472
          • getprop ro.miui.ui.version.name
            2⤵
              PID:6526
            • getprop ro.miui.ui.version.name
              2⤵
                PID:6571
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:6614
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:6657

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.library.hollow/app_DynamicOptDex/CeMmSnF.json
                  Filesize

                  238KB

                  MD5

                  f5d8865e51ee17215230600c35aa0542

                  SHA1

                  edf8b823589ed6fc4508a88dd7c8c67fb9c4966a

                  SHA256

                  260a042b7ba49cdfef7b42bf6f66142004bb767d2352fa4112e590ace74fd81b

                  SHA512

                  1b21b1107e19d2c09a0f0df77973df0c82f9569070b56ab0d89df5569187a7670055889a6efd4d880cc71de5d3a8c9f5dc4fca28d040053c79104dbd17556ef4

                  Download Submit

                • /data/user/0/com.library.hollow/app_DynamicOptDex/CeMmSnF.json
                  Filesize

                  483KB

                  MD5

                  2a7b8d887cc8d4ec1988a108e9e32bd1

                  SHA1

                  1eaf4c45de142de9c5a31a587bb4c13e06c2f2da

                  SHA256

                  0e0a0421098a0234bb27d54e616abdb71f496cbca8dd9044abdcc92bb1b9ae3a

                  SHA512

                  a9066db37e50d83440853feb14e5b2261244049626dcb0a6cfaaf661d3eb7bf57e2e1997e2414ceaed2b53cb6d1b2017c8353de9da359211584e4877c7c58e3e

                  Download Submit

                • /data/user/0/com.library.hollow/app_DynamicOptDex/oat/CeMmSnF.json.cur.prof
                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                  Download Submit