Analysis

  • max time kernel
    611481s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    02/06/2022, 11:24

General

  • Target
    983CD93CEEC7451EED08DEA0C83B05E9665E8AE0C433B564EFCC55657EBC2598.apk
  • Size 2.2MB
  • Sample220602-nh66waffc7
  • SHA256 983cd93ceec7451eed08dea0c83b05e9665e8ae0c433b564efcc55657ebc2598
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • alienbot

C2
  • http://ukalasey2.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm
    1⤵
    • Loads dropped Dex/Jar
    PID:6277
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6369

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GXsTi.json

          • Path /data/user/0/ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm/app_DynamicOptDex/GXsTi.json
          • Size 767KB
          • SHA256 34fe80e5af092d641e11e042f7aec42f9b68231959c113e28c801741c18ce211
          • MD5 SHA1 SHA512 SSDEEP

          GXsTi.json

          • Path /data/user/0/ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm/app_DynamicOptDex/GXsTi.json
          • Size 767KB
          • SHA256 1e968ee9b7a194c662b4fab586c6ed7139101b742b22258b7580012a420483bc
          • MD5 SHA1 SHA512 SSDEEP

          GXsTi.json

          • Path /data/user/0/ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm/app_DynamicOptDex/GXsTi.json
          • Size 767KB
          • SHA256 1e968ee9b7a194c662b4fab586c6ed7139101b742b22258b7580012a420483bc
          • MD5 SHA1 SHA512 SSDEEP