Overview

overview

10

Static

static

7

BB67C8D6B6...EB.apk

android_x86

10

BB67C8D6B6...EB.apk

android_x64

10

BB67C8D6B6...EB.apk

android_x64

Analysis

  • max time kernel
    609776s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    02-06-2022 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BB67C8D6B6A011C14443DE79246D12F4178C344F73550414886F849D0F5BC4EB.apk

  • Size

    2.1MB

  • MD5

    b365a59f701c50ddfe445713b6573b11

  • SHA1

    837a51e21cd010d46afbb0a76571945dde9ed705

  • SHA256

    bb67c8d6b6a011c14443de79246d12f4178c344f73550414886f849d0f5bc4eb

  • SHA512

    21e0c5148f95fdb2d5fb24ba79c13533d33106b905581bf7d806c8d8e11f92c841a5dd70515d3f212ac2e464234b15d417d3e2b3dbee7c4638ce0fc5b8fe35a6

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://kasstismur.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5128
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/NTfONu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/oat/x86/NTfONu.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5155

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/NTfONu.json
    Filesize

    726KB

    MD5

    1c87d862b20580742e8f7dfb2493571d

    SHA1

    bba253b3e96e9259777b53abb983018ab02099c4

    SHA256

    6bcafad6dd306c342974ab075c84e8f0c76b73d77dab2f3e0436acb5cae8e62a

    SHA512

    af41485898172adf7e2b214ba71cc1b807796e1dd27a64ddef36e170fbd3767654281fcc8f6f7bd981c0d638a2446f46be3cbfa082236bc04b75e244dfd80ed7

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/NTfONu.json
    Filesize

    726KB

    MD5

    766644e0c67e4cd3b2b725d54ac3ba45

    SHA1

    33efdb02147ecf54e1f1f6049125e5be0df23f26

    SHA256

    365cf1231bee6ff67d9a73fffb22616c6db0393eed93cce828547dd168868f8f

    SHA512

    9063d76acf6d269d5723a3b86d6c73b05bc27c18091213ec2fd1ee9890abc467646019369d5cd6b61495e0bef973f4b0a9813b2cc2b3bc9749b60986a03d9e95

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/NTfONu.json
    Filesize

    726KB

    MD5

    8c2f9636ce13415cc251c1be359c1742

    SHA1

    0e94f8bd7c401e9b6d9f82c8fb4cc8692e056c88

    SHA256

    b3645bb8e14e7dc497e98c273e06033f643abd8075b5531ea8013a375809f00a

    SHA512

    27cb7023343b0b34eb78d6697e53c00e097cb15b127b2888bfc116e07b747531a08d230a35c07eb7597ef43bbb73b610a12fe1124d7336b5fcf1ea8f81946390

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/NTfONu.json
    Filesize

    726KB

    MD5

    766644e0c67e4cd3b2b725d54ac3ba45

    SHA1

    33efdb02147ecf54e1f1f6049125e5be0df23f26

    SHA256

    365cf1231bee6ff67d9a73fffb22616c6db0393eed93cce828547dd168868f8f

    SHA512

    9063d76acf6d269d5723a3b86d6c73b05bc27c18091213ec2fd1ee9890abc467646019369d5cd6b61495e0bef973f4b0a9813b2cc2b3bc9749b60986a03d9e95

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/NTfONu.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/oat/NTfONu.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/oat/x86/NTfONu.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/suygeukdpmo.jnthxtcmwra.ucetxonjfkdwsec/app_DynamicOptDex/oat/x86/NTfONu.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit