Extracted

• • Target

    5b93b96a488c65fe27d501e9d98a397803b52590797e5e39c61b2e58e86bc2ac

  • Size

    1.3MB

  • MD5

    eb9ca5afc6e401a47758d213c3f39362

  • SHA1

    f06f89f57e952a34155d8d9a7c6651ce1674d00f

  • SHA256

    5b93b96a488c65fe27d501e9d98a397803b52590797e5e39c61b2e58e86bc2ac

  • SHA512

    f897e25e5bc28b783472a720f447c623181a2f1ae56c3cee6d6e84f5b4c8f95ae4428800934268c50a3d5d31d49336989d2fdbd68688b226980fca9b4dacd031

  • SSDEEP

    24576:8H0Hb6rN7quGtaQwrYPF1btpfKEBvBQiLS4jBgpB+mv47BFn1mtFPRb:8H0H8N7quS0Y/tNnBvBQI/BgpB+rTIPp

  Score

  10^/10

  alienbotbankerevasioninfostealerransomwaretrojan

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Renames multiple (160) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Renames multiple (164) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Removes a system notification.

    evasion
  behavioral1behavioral2behavioral3