Analysis

  • max time kernel
    676898s
  • max time network
    172s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    03-06-2022 06:27

General

  • Target

    32376BAF8D01AB49E8A4B35EC35BC27FAB99B66BCEFCB160A7878E724D68BC3D.apk

  • Size

    1.8MB

  • MD5

    e07dd64ed4031f2335f378c3c8a92ad4

  • SHA1

    b5a40dcc077c4fe6c6b124a11d429d6fbd403184

  • SHA256

    32376baf8d01ab49e8a4b35ec35bc27fab99b66bcefcb160a7878e724d68bc3d

  • SHA512

    25f3e93d5f4508549600e8da98d124431efc97f80101bf888100c9722beae4d025b77a8af93d75cd1091030e0ad81d46e3d6eb6b306328686f2122ff10aeccc3

Malware Config

Extracted

Family

alienbot

C2

http://cacecarsa4.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea
    1⤵
    • Loads dropped Dex/Jar
    PID:6165
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6428
      • getprop ro.miui.ui.version.name
        2⤵
          PID:7188

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

        Filesize

        767KB

        MD5

        b8f550490a6a7cdb785312379bcb8580

        SHA1

        da3317c21a9b20aecc5a817d3311dbc7d4621c50

        SHA256

        81f9b2c596316ab91e30896d51a1c39e8d9ce38a903579f44b57289354ebd9bc

        SHA512

        f5f16f55490e6839801197cae3947266a63d0c67c120049f4e759a0d5dae85b9184c64f7e5194232c3a96ae3dda408fd92457bca3e6f85407d21ccbb2dc73249

      • /data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

        Filesize

        767KB

        MD5

        4ed3407ee5506b487ccc84536e4d40fd

        SHA1

        f31c979d8d68390196d5520416483bd0e8c30138

        SHA256

        c0349fc15d53c193dbe06f698e96192919bcb00c7f83cf35fb8c1fec4a2ac887

        SHA512

        dcbe67d6fda298fea336fc87ca9649c63f776a042ba24028d7a11ad7dc8c1b853bdc6439264d72fc2439d0e66584ad8ab8cc1aea9dc87be0fc407202dc9f701c

      • /data/user/0/ehgogeeqcptb.btlgynggifhoyblwsag.ewljfqrsoebagcpfkeea/app_DynamicOptDex/AQXC.json

        Filesize

        767KB

        MD5

        4ed3407ee5506b487ccc84536e4d40fd

        SHA1

        f31c979d8d68390196d5520416483bd0e8c30138

        SHA256

        c0349fc15d53c193dbe06f698e96192919bcb00c7f83cf35fb8c1fec4a2ac887

        SHA512

        dcbe67d6fda298fea336fc87ca9649c63f776a042ba24028d7a11ad7dc8c1b853bdc6439264d72fc2439d0e66584ad8ab8cc1aea9dc87be0fc407202dc9f701c