Overview

overview

10

Static

static

7

7B5F6D8B93...CF.apk

android_x86

10

7B5F6D8B93...CF.apk

android_x64

10

7B5F6D8B93...CF.apk

android_x64

10

Analysis

  • max time kernel
    607305s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    02/06/2022, 11:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7B5F6D8B93D3DBE982F87BE3988B7323CBA198944E2AFDC2B8143347FC17DBCF.apk

  • Size

    2.1MB

  • MD5

    29914c9b705f3446486261c1081aeccf

  • SHA1

    787c4a114cb1dc1ab91b93d35154b363778a8414

  • SHA256

    7b5f6d8b93d3dbe982f87be3988b7323cba198944e2afdc2b8143347fc17dbcf

  • SHA512

    b391917408018b5cf8e99d00462eeb08d9403a037458d0588e29d9d30b3dbd719d7ffa4a0c8118bbd24240c7440ae4edd979760263eb7f82ab33fedb5ac5b801

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://apk-file.ru.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:6244
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6465
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6562
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7046
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7430

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json
            Filesize

            756KB

            MD5

            575e54e078f15fc51f916be9fbb177ad

            SHA1

            6ad2701fdcccc7999e743d53e50fdf7763fe75a7

            SHA256

            79594c44226fc6772fb086d8a020204ad2540aaa5f4c9abca86b60ae000578c2

            SHA512

            ed8daeaf598c9b47709a266556104752166f068041c91822cf576ce81004e3f3313c398ea27be7e8feb7cb6e82f17cacf23baeb13b595a2125e7d4cf45fc1848

            Download Submit

          • /data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json
            Filesize

            756KB

            MD5

            c794df2a11248cb510f9f64aa64c8454

            SHA1

            34424960050861fae48c452631ab7327da72229c

            SHA256

            7a89cb0c9a118a79d6ccb404b9d853dccc875f5f531d2afafa56695222576a1a

            SHA512

            782692f5fe24883389509153a049d140b7344e79458566732b49c008e62692dd0dc6d95d7a7850dcc7a62a03684d67b28bc5415ba371b776e4b0c1008e6bfe7f

            Download Submit

          • /data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json
            Filesize

            756KB

            MD5

            c794df2a11248cb510f9f64aa64c8454

            SHA1

            34424960050861fae48c452631ab7327da72229c

            SHA256

            7a89cb0c9a118a79d6ccb404b9d853dccc875f5f531d2afafa56695222576a1a

            SHA512

            782692f5fe24883389509153a049d140b7344e79458566732b49c008e62692dd0dc6d95d7a7850dcc7a62a03684d67b28bc5415ba371b776e4b0c1008e6bfe7f

            Download Submit