alienbot | 4d1174234d40792da0ae5656f309865d634f288783ec430ee5308d55101b5369

Resubmissions

12-07-2022 04:08

220712-eqexxschg7 10

Analysis

max time kernel
4038567s
max time network
133s
platform
android_x64
resource
android-x64-20220621-en
submitted
12-07-2022 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d1174234d40792da0ae5656f309865d634f288783ec430ee5308d55101b5369.apk
Size

3.7MB
MD5

98a55dc8317b3615ebc222a19d7aa77c
SHA1

10cf620246a4ceec29e3b3b253e40d0a26ddf18d
SHA256

4d1174234d40792da0ae5656f309865d634f288783ec430ee5308d55101b5369
SHA512

130694cc309efc5579aad5d0459595024b86332ececbfb587a0ee0409814c2f6356b996045741dc3dc233c280d572879347dae8c78aa2129fe834c8e3e2a7aae

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

http://esipx.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

tobacco.kitten.where

ioc	pid	Process
/data/user/0/tobacco.kitten.where/app_DynamicOptDex/WcAfD.json	5305	tobacco.kitten.where
/data/user/0/tobacco.kitten.where/app_DynamicOptDex/WcAfD.json	5305	tobacco.kitten.where

tobacco.kitten.where
1⤵
- Loads dropped Dex/Jar
PID:5305
- getprop ro.miui.ui.version.name
  2⤵
  PID:6566
- getprop ro.miui.ui.version.name
  2⤵
  PID:6790

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/tobacco.kitten.where/app_DynamicOptDex/WcAfD.json

Filesize
760KB

MD5
398d341caa64b29f501f83007d70ec05

SHA1
82d4f8735327bc6d4b3d27b9bc2bbe90c14434d1

SHA256
10d824c3f96847cb50b204857935ae0e29e5ad0a1f174d8cf49080bde9b38f8a

SHA512
fc755f735d1a5fff23eeac104a10e0eb4c84a73e15bca39ff56fb6b1fc4d337ddc07107536fb220d92666794f364b35d998062c2b9587f550f3a4968b13e18d7

Download Submit
/data/user/0/tobacco.kitten.where/app_DynamicOptDex/WcAfD.json

Filesize
760KB

MD5
8e70b9d045c681a4d4fce91333df8415

SHA1
23998137103bce2ee029bcd2fd21304980a711e9

SHA256
12ef0984d7f7b54331c952d1f2c5dc755e2ba91791055dedba8a694c42617c98

SHA512
75cb394cdcd94db2ed73c6175c4a8c29df16d63f5f765f07f8c7a3e9c45a31d2bf1b0233e4bfba398cc591659357cedcdc1693219b8910004f689550ba536caf

Download Submit
/data/user/0/tobacco.kitten.where/app_DynamicOptDex/WcAfD.json

Filesize
760KB

MD5
8e70b9d045c681a4d4fce91333df8415

SHA1
23998137103bce2ee029bcd2fd21304980a711e9

SHA256
12ef0984d7f7b54331c952d1f2c5dc755e2ba91791055dedba8a694c42617c98

SHA512
75cb394cdcd94db2ed73c6175c4a8c29df16d63f5f765f07f8c7a3e9c45a31d2bf1b0233e4bfba398cc591659357cedcdc1693219b8910004f689550ba536caf

Download Submit
/data/user/0/tobacco.kitten.where/app_DynamicOptDex/oat/WcAfD.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit