Overview

overview

10

Static

static

7

67D2F328C5...44.apk

android_x86

10

67D2F328C5...44.apk

android_x64

10

67D2F328C5...44.apk

android_x64

Analysis

  • max time kernel
    596548s
  • max time network
    164s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    02-06-2022 08:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    67D2F328C59F4A2866006CDD18CA81C9E3F882D585FC42B244FF397293087C44.apk

  • Size

    2.3MB

  • MD5

    3efa6d294bd8115fcd1b228fbb388a44

  • SHA1

    11440309458acdce2514b531ea1057f4a8ed04c1

  • SHA256

    67d2f328c59f4a2866006cdd18ca81c9e3f882d585fc42b244ff397293087c44

  • SHA512

    c4b3ff7287dc7fc7c7359c8dd8ffb4c2eb0dc39a0f5d3305aeb69225d54b0dd15272d0cdc5086bb79d18a05f22e06b48481fc8b96c55087304693551265c8075

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://ukalasey9.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5365
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5419

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json
    Filesize

    706KB

    MD5

    e9646addf858cb8fef1340cf602b54c5

    SHA1

    5b88752ec68102c6f53869c5fc528e0767a0d8f1

    SHA256

    4eba0bb2141a6f6d6f62e10c2f1c01ae770ab2041da4329b718c2aa2f21ce6bb

    SHA512

    be2dc2dfef19e265c3569211248e8ec43a69c2ee8413735f4249c55be3cc87d2163361792a15e444be890fed8563e1bf3c2576bdf80b015565bc210e11da31ad

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json
    Filesize

    706KB

    MD5

    eed7eac54814ff6acec44d5a14a1a4f9

    SHA1

    c80b000cc27762330e7fb7216f6dcc626675e9e7

    SHA256

    0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

    SHA512

    4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json
    Filesize

    706KB

    MD5

    cd9be3cc70e271e1411448d4e97bfdb0

    SHA1

    73dfa21e3169852e2cca1727c067cf312b47944d

    SHA256

    24a3c1528d837ee6bec088511d693fab21490aa57618b0a67a3efa7b6beb916b

    SHA512

    9ec842107fc6cfc56b1efe7f034bc9faad68578625065d836da78d8d79f64c1106641dd1039147d547d93c1fda8c1c3af3829a98b9813e112a8ab915a1414149

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json
    Filesize

    706KB

    MD5

    eed7eac54814ff6acec44d5a14a1a4f9

    SHA1

    c80b000cc27762330e7fb7216f6dcc626675e9e7

    SHA256

    0242de382adfa4be23d52722eb2e8e679fa9d5475af52a546ddea08ea182b772

    SHA512

    4f3dfa5d653c7ce20328c950ea87b2e3fd6f03722d305cdad0ea708142131b994efccb64c3e0d51b512bd1ade0bf9ac71964f86f1644e92248da8efae57d6889

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/OO.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/OO.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/ombuylaehfkkyrbdli.lijnwihlodoiaadpsg.lsyneuwfijf/app_DynamicOptDex/oat/x86/OO.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit