Analysis

  • max time kernel
    611909s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    02/06/2022, 11:27

General

  • Target
    db026fe524d1ce98de04374ff374fdf0.apk
  • Size 1.9MB
  • Sample220602-nkd8waffe5
  • SHA256 dc215663af92d41f40f36088ec1b850b81092ea94a4a061a9ce88178daee965a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • alienbot

C2
  • http://servicesc.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr
    1⤵
    • Loads dropped Dex/Jar
    PID:6362
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6458
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6548

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            jeSk.json

            • Path /data/user/0/msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr/app_DynamicOptDex/jeSk.json
            • Size 723KB
            • SHA256 3687b59d4b8a3ecaa164f5f04301303ce0192fdc2c296df20b3dc209cc3d2776
            • MD5 SHA1 SHA512 SSDEEP

            jeSk.json

            • Path /data/user/0/msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr/app_DynamicOptDex/jeSk.json
            • Size 723KB
            • SHA256 83c6d3e8bef45f67a9dcdc5f648cea621fb08d45da0421fbb383b14187cc1042
            • MD5 SHA1 SHA512 SSDEEP

            jeSk.json

            • Path /data/user/0/msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr/app_DynamicOptDex/jeSk.json
            • Size 723KB
            • SHA256 83c6d3e8bef45f67a9dcdc5f648cea621fb08d45da0421fbb383b14187cc1042
            • MD5 SHA1 SHA512 SSDEEP