alienbot | e05619e7cfffe56f175a1bd2dda5fddca2d53c016615538be87f6a1e7c7cc0aa

Analysis

max time kernel
40s
max time network
157s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
08-02-2024 22:05

Target

e05619e7cfffe56f175a1bd2dda5fddca2d53c016615538be87f6a1e7c7cc0aa.apk
Size

785KB
MD5

774f48222eed4f8fa61d3429b5a15f7f
SHA1

eae8822d463fb2f81f24fc62fa0595e24457a282
SHA256

e05619e7cfffe56f175a1bd2dda5fddca2d53c016615538be87f6a1e7c7cc0aa
SHA512

3c0df9825efe9a2ce208cfffd4a9220509b1255e213c01fe8a98c2a83c28bf5fcd5f015d2d23bdcbe896a2c9cb7bdd5731268072a7c7481ef677b66e485f9db1
SSDEEP

12288:wMuGOsU8xN9Zo1yCQzoqKqRazgLx9+0qwF11bnZ84S8EH8EYZpZM/Im98/Im9B:w0xfsbBqRaMC0q4jbn3hEcEH/d98/d9B

Score

10^/10

Family

alienbot

http://91.210.169.114/

AES_key

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.sakkkwyl.ncceberwpdhfq

pid process

4624 com.sakkkwyl.ncceberwpdhfq
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.sakkkwyl.ncceberwpdhfq

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.sakkkwyl.ncceberwpdhfq

pid	process
4624	com.sakkkwyl.ncceberwpdhfq

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.sakkkwyl.ncceberwpdhfq

com.sakkkwyl.ncceberwpdhfq
1⤵
- Removes its main activity from the application launcher
- Uses Crypto APIs (Might try to encrypt user data)
PID:4624