alienbot | 98d85e9e46043780fc863a30d149505e377c82f2d668afae4fb4c647bf07a9af | Triage

Analysis

max time kernel
606441s
max time network
168s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
02-06-2022 11:16

Sharing

Report Analysis Logs

General

Target

98D85E9E46043780FC863A30D149505E377C82F2D668AFAE4FB4C647BF07A9AF.apk
Size

456KB
MD5

b72c6108be79544049a01a1e35769f9d
SHA1

8e32645c945c37fe68d42dd439a65dc6efae8e5f
SHA256

98d85e9e46043780fc863a30d149505e377c82f2d668afae4fb4c647bf07a9af
SHA512

383761c5584a25626c8ab5ece2c723110f32cae412fedb4f8036cbd82e13c23ea08e1f56adfc21ef845c1f38083fffb21ff614fc5ed05b5c77ea657925556d59

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://kremmilk.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.hcgetl.nysgtxkveqdzrpb

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hcgetl.nysgtxkveqdzrpb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hcgetl.nysgtxkveqdzrpb

com.hcgetl.nysgtxkveqdzrpb
1⤵
- Makes use of the framework's Accessibility service.
PID:6642
- getprop ro.miui.ui.version.name
  2⤵
  PID:6744
- getprop ro.miui.ui.version.name
  2⤵
  PID:6859
- getprop ro.miui.ui.version.name
  2⤵
  PID:7032
- getprop ro.miui.ui.version.name
  2⤵
  PID:7088
- getprop ro.miui.ui.version.name
  2⤵
  PID:7129
- getprop ro.miui.ui.version.name
  2⤵
  PID:7161
- getprop ro.miui.ui.version.name
  2⤵
  PID:7201

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads