Analysis

  • max time kernel
    2762625s
  • max time network
    182s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • submitted
    27/06/2022, 10:11

General

  • Target
    3382348F9618058DDE3AACFFCB34982E.apk
  • Size 1.5MB
  • Sample220627-l77gtsadbn
  • SHA256 f57a44bec2f7af2da443f068edb0a743f9625ac3a9d686393bacb8e72274b5de
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • alienbot

C2
  • http://scargkanesiki.info/

  • http://adkfjsadlkgjasdlkjaslkgjargq0rg.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • irbqyuyjucec.xkypc.srowoc
    1⤵
    • Loads dropped Dex/Jar
    PID:6210
    • getprop ro.miui.ui.version.name
      2⤵
        PID:6452
      • getprop ro.miui.ui.version.name
        2⤵
          PID:6915

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            JkCIgr.json

            • Path /data/user/0/irbqyuyjucec.xkypc.srowoc/app_DynamicOptDex/JkCIgr.json
            • Size 357KB
            • SHA256 f592f92764ebd3f274b6ff68fe6ea2d9efa9ec10cb5c2e5f5033f840b034c40b
            • MD5 SHA1 SHA512 SSDEEP

            JkCIgr.json

            • Path /data/user/0/irbqyuyjucec.xkypc.srowoc/app_DynamicOptDex/JkCIgr.json
            • Size 357KB
            • SHA256 ebcdce55f409e5c4ed10144749f5b82bf0d94e4ee715595aa4a267f05b05c301
            • MD5 SHA1 SHA512 SSDEEP

            JkCIgr.json

            • Path /data/user/0/irbqyuyjucec.xkypc.srowoc/app_DynamicOptDex/JkCIgr.json
            • Size 357KB
            • SHA256 ebcdce55f409e5c4ed10144749f5b82bf0d94e4ee715595aa4a267f05b05c301
            • MD5 SHA1 SHA512 SSDEEP