Overview

overview

10

Static

static

7

68807B45C7...65.apk

android_x86

10

68807B45C7...65.apk

android_x64

10

68807B45C7...65.apk

android_x64

10

Analysis

  • max time kernel
    608210s
  • max time network
    172s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    02-06-2022 11:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68807B45C752F41989F19651AD1A5E55ADDD57C8420DF5C39D2B59A577123A65.apk

  • Size

    1.8MB

  • MD5

    0540a0998b2c3f0395b192a42a1cbc7e

  • SHA1

    4c9ff01441aace76582d355acb6b219762c2bab3

  • SHA256

    68807b45c752f41989f19651ad1a5e55addd57c8420df5c39d2b59a577123a65

  • SHA512

    f048a77ed41465cf65c8345e6a66a78503ce0ffb0cda13d0a90658ecb8461179f37c19fb352e3ac2d5b015704210f0b10576847d8ce3f632f551bc22956c5893

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://cacecarsa5.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • mkwqsaepupwqonfytg.pyd.ipydwgtgi
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:6976
    • getprop ro.miui.ui.version.name
      2⤵
        PID:7077
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7208
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7245
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7303
            • getprop ro.miui.ui.version.name
              2⤵
                PID:7339
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:7377
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:7411

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/mkwqsaepupwqonfytg.pyd.ipydwgtgi/app_DynamicOptDex/dIT.json
                  Filesize

                  706KB

                  MD5

                  cac80fd4ff2177ab8217e013a62d384e

                  SHA1

                  4a4d0f335daa3698c65b90895dacc4260ee5fc52

                  SHA256

                  6ba410933e4de3481073f646ace33a61238939e03473cf301897f77be3a537f0

                  SHA512

                  3477406c90d539bc1f3d916a91ed4259baa39614ec82cc67cb00b825620eb4eea2752a38e014fa9c32ce2bf9de351512883f033ad32201a8090c3e839f0a35b4

                  Download Submit

                • /data/user/0/mkwqsaepupwqonfytg.pyd.ipydwgtgi/app_DynamicOptDex/dIT.json
                  Filesize

                  706KB

                  MD5

                  67659f3ef3e41646e828264a2860977b

                  SHA1

                  bdfbcc3d0b5491a5d91dc5c931f94ac6c4cf65df

                  SHA256

                  1a1069296f19416ea2a69731a24f5d7a0dce31201611dd73d7be1f06e487a956

                  SHA512

                  bc4e97f9a5e73c2adc4ce2b3574be3b804000ea155bb9cf73ee4c94aadaae7ccc49fe21a5bf7c2077cdc679466c5f613c4cf6280b5eae8562638491976d69fb4

                  Download Submit

                • /data/user/0/mkwqsaepupwqonfytg.pyd.ipydwgtgi/app_DynamicOptDex/dIT.json
                  Filesize

                  706KB

                  MD5

                  67659f3ef3e41646e828264a2860977b

                  SHA1

                  bdfbcc3d0b5491a5d91dc5c931f94ac6c4cf65df

                  SHA256

                  1a1069296f19416ea2a69731a24f5d7a0dce31201611dd73d7be1f06e487a956

                  SHA512

                  bc4e97f9a5e73c2adc4ce2b3574be3b804000ea155bb9cf73ee4c94aadaae7ccc49fe21a5bf7c2077cdc679466c5f613c4cf6280b5eae8562638491976d69fb4

                  Download Submit