General
-
Target
com.CredemMobile.apk
-
Size
1.8MB
-
Sample
230712-lmqctacf88
-
MD5
72a4c5ae2e38026b0007f6e3fba9824e
-
SHA1
71bfb36941a37a4cb4b5d501f63c654f240f9176
-
SHA256
61a589469a443a6997304da392a258cd5ddd2068f53b25e0b01d9ec86d651f17
-
SHA512
b34552a4abb685de7a833ae538bf2a0e0adb067ac603cfde64ef0acb0130b4bc7219e52ba1abdc1e99f8d1623c8222ff4f9dbd6cf03496998a34b18f1d9c11c5
-
SSDEEP
49152:DjI+HhliB/qCYfdfQyxFFTF+3M9tqjCMlm6jBbBg:1HniB/qCODZjtq958
Static task
static1
Malware Config
Extracted
alienbot
http://soofoodoo.club
Targets
-
-
Target
com.CredemMobile.apk
-
Size
1.8MB
-
MD5
72a4c5ae2e38026b0007f6e3fba9824e
-
SHA1
71bfb36941a37a4cb4b5d501f63c654f240f9176
-
SHA256
61a589469a443a6997304da392a258cd5ddd2068f53b25e0b01d9ec86d651f17
-
SHA512
b34552a4abb685de7a833ae538bf2a0e0adb067ac603cfde64ef0acb0130b4bc7219e52ba1abdc1e99f8d1623c8222ff4f9dbd6cf03496998a34b18f1d9c11c5
-
SSDEEP
49152:DjI+HhliB/qCYfdfQyxFFTF+3M9tqjCMlm6jBbBg:1HniB/qCODZjtq958
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload
-
Makes use of the framework's Accessibility service.
-
Acquires the wake lock.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-