Analysis

  • max time kernel
    611510s
  • max time network
    171s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    02/06/2022, 11:24

General

  • Target
    A4B7579BDB00A60461BE39F8579E12C6B0F2C239547CEDF9F18C5C6ECCFBBCE3.apk
  • Size 2.0MB
  • Sample220602-nh8dyaffc8
  • SHA256 a4b7579bdb00a60461be39f8579e12c6b0f2c239547cedf9f18c5c6eccfbbce3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • alienbot

C2
  • http://ukalasey.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • izkedmghbqdztn.iinequq.xzic
    1⤵
    • Loads dropped Dex/Jar
    PID:6282
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6413
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6504

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GrgeQPO.json

            • Path /data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json
            • Size 703KB
            • SHA256 3aa437b266ee4c7cea62dee32fb1f6f6ee16bdf6d07c7c66edf274f98ff96fe4
            • MD5 SHA1 SHA512 SSDEEP

            GrgeQPO.json

            • Path /data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json
            • Size 703KB
            • SHA256 0780edaaadb40bb021f76f3007666e40d2c25f9c9bb4afad4fcb904e38d44da8
            • MD5 SHA1 SHA512 SSDEEP

            GrgeQPO.json

            • Path /data/user/0/izkedmghbqdztn.iinequq.xzic/app_DynamicOptDex/GrgeQPO.json
            • Size 703KB
            • SHA256 0780edaaadb40bb021f76f3007666e40d2c25f9c9bb4afad4fcb904e38d44da8
            • MD5 SHA1 SHA512 SSDEEP