Analysis
-
max time kernel
607678s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20220310-en -
submitted
02-06-2022 11:24
Static task
static1
Behavioral task
behavioral1
Sample
983CD93CEEC7451EED08DEA0C83B05E9665E8AE0C433B564EFCC55657EBC2598.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
983CD93CEEC7451EED08DEA0C83B05E9665E8AE0C433B564EFCC55657EBC2598.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
983CD93CEEC7451EED08DEA0C83B05E9665E8AE0C433B564EFCC55657EBC2598.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
983CD93CEEC7451EED08DEA0C83B05E9665E8AE0C433B564EFCC55657EBC2598.apk
-
Size
2.2MB
-
MD5
95cfd5efd2526e4166849004b357effe
-
SHA1
e57518888c1e20a71cfd9e3fb41f04dc6fd066b7
-
SHA256
983cd93ceec7451eed08dea0c83b05e9665e8ae0c433b564efcc55657ebc2598
-
SHA512
d5059df8b04d5b91c2afcddf92f531db82ee7bd65d73273ae6625252605589acd29ffc2b443fe9438e2b9d3ddeb1d63a3c27187f66383e1faf115ad90d0ed032
Malware Config
Extracted
alienbot
http://ukalasey2.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm/app_DynamicOptDex/GXsTi.json 5848 ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm /data/user/0/ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm/app_DynamicOptDex/GXsTi.json 5848 ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm
Processes
-
ctsdijqewczjhww.gnsxtstbwrjbrxh.mkypmybqnlsidgxzunmwbekbm1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5848 -
getprop ro.miui.ui.version.name2⤵PID:6023
-
-
getprop ro.miui.ui.version.name2⤵PID:6122
-
-
getprop ro.miui.ui.version.name2⤵PID:6164
-
-
getprop ro.miui.ui.version.name2⤵PID:6236
-
-
getprop ro.miui.ui.version.name2⤵PID:6272
-
-
getprop ro.miui.ui.version.name2⤵PID:6308
-
-
getprop ro.miui.ui.version.name2⤵PID:6342
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
767KB
MD52bc89aade90294152d7ea29e36ac48e9
SHA14d1e4ca7044e97798aa88eb6829e3664dc41628b
SHA25634fe80e5af092d641e11e042f7aec42f9b68231959c113e28c801741c18ce211
SHA512ad0a3b986677910e77e5466f8d5b4eb4255e5ec313283f3dadc22458382971f1416114df51d400a27ff8de0eb6c0a79977ccbe6b665c5fa8c71f7074336914ef
-
Filesize
767KB
MD5d4d6d0f4cbfe76d620ced317c2240137
SHA1f62e5ac2e1f388b074907da335979acc4abb2919
SHA2561e968ee9b7a194c662b4fab586c6ed7139101b742b22258b7580012a420483bc
SHA512312c16a82c21d1d2a7e013352d4ffbc039de27f6b680898e2c72e8d9395d9e28a77006d678b99a99649a4abecf089dbb8be304accb9286f1830086b6b32cdbb6
-
Filesize
767KB
MD5d4d6d0f4cbfe76d620ced317c2240137
SHA1f62e5ac2e1f388b074907da335979acc4abb2919
SHA2561e968ee9b7a194c662b4fab586c6ed7139101b742b22258b7580012a420483bc
SHA512312c16a82c21d1d2a7e013352d4ffbc039de27f6b680898e2c72e8d9395d9e28a77006d678b99a99649a4abecf089dbb8be304accb9286f1830086b6b32cdbb6