Overview

overview

10

Static

static

7

3EA328435A...8F.apk

android_x86

10

3EA328435A...8F.apk

android_x64

10

3EA328435A...8F.apk

android_x64

10

Analysis

  • max time kernel
    676565s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    03-06-2022 06:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3EA328435AE3828967D6716963F8911C00DF7B5079BFBAD2A8F13EDF7F9ADE8F.apk

  • Size

    2.1MB

  • MD5

    77a63aa3c70d1f8622532357a170c9e5

  • SHA1

    a6ee805d28909c31adc8293bb91e11c3ce074a32

  • SHA256

    3ea328435ae3828967d6716963f8911c00df7b5079bfbad2a8f13edf7f9ade8f

  • SHA512

    3d2f37accdfdbe9a5addc0c12eb804cc3e7378112f5fd5c27fafc039d487d3458ced50f9ba610a78f09fa11ceb9bb61dfeeb7767ce78ff2e7c60163d190ebded

Score
10/10
alienbotbankerinfostealertrojan

Malware Config

Extracted

Family

alienbot

C2

http://cacecarsa.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • spchehkpnlikmo.zrmxdqznbiqikngatz.qhnjqhmc
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:6680
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6770
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6967
        • getprop ro.miui.ui.version.name
          2⤵
            PID:7020
          • getprop ro.miui.ui.version.name
            2⤵
              PID:7073

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/user/0/spchehkpnlikmo.zrmxdqznbiqikngatz.qhnjqhmc/app_DynamicOptDex/GtZAm.json
            Filesize

            790KB

            MD5

            51884f81becd897b170f31be1ccf0f6b

            SHA1

            b022bbf4fcbb7f8a94487e25edffbe9d340cf803

            SHA256

            a7860f90be5fdcf49de83beea9967d5609408478f2f4a2c00c3ace86d20ebf35

            SHA512

            66241967fd963ba1ab4fa0ab04ce7477d48faa70770de80a6a0e9700a7560e838b961a5f5bbe54a4fed18492949cc04b1858bdb847fc6dced26bc9fdb4f6fedb

            Download Submit

          • /data/user/0/spchehkpnlikmo.zrmxdqznbiqikngatz.qhnjqhmc/app_DynamicOptDex/GtZAm.json
            Filesize

            790KB

            MD5

            1c8cd0f6d070de390a4505db90838e24

            SHA1

            fc73a0d23d02f9ae35b422fc38653e5017bb96e7

            SHA256

            ee3942d7035ceecc0025709dcc0c9928a1a902ba921b4e2de69cd54b0ed16bee

            SHA512

            71026cf1e2616792e19427fb3c142d13e50d3c3eec729975b87ac920bb9cd846b4f1b217fec2c8d22a3559d8a5514358838d8df3a273de839228047f46696bc2

            Download Submit

          • /data/user/0/spchehkpnlikmo.zrmxdqznbiqikngatz.qhnjqhmc/app_DynamicOptDex/GtZAm.json
            Filesize

            790KB

            MD5

            1c8cd0f6d070de390a4505db90838e24

            SHA1

            fc73a0d23d02f9ae35b422fc38653e5017bb96e7

            SHA256

            ee3942d7035ceecc0025709dcc0c9928a1a902ba921b4e2de69cd54b0ed16bee

            SHA512

            71026cf1e2616792e19427fb3c142d13e50d3c3eec729975b87ac920bb9cd846b4f1b217fec2c8d22a3559d8a5514358838d8df3a273de839228047f46696bc2

            Download Submit

          • /data/user/0/spchehkpnlikmo.zrmxdqznbiqikngatz.qhnjqhmc/app_DynamicOptDex/oat/GtZAm.json.cur.prof
            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            Download Submit