Analysis
-
max time kernel
784018s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm-20230824-en -
resource tags
-
submitted
25/08/2023, 22:01
General
-
Target
d7decbee41ee4b8d4e39a35763a8c9a639e61113835354d08f1a0cf56635116c.apk
-
Size
2.3MB
-
MD5
619c1a75736196cc2860e3975becf951
-
SHA1
a463890ffb01fe52da49e9869fe8f4088a8990de
-
SHA256
d7decbee41ee4b8d4e39a35763a8c9a639e61113835354d08f1a0cf56635116c
-
SHA512
06a7685f3cf411b4054b3e86064f477e0db3b7f852c5e18c1ed089d13dd71b3f19c8b6e794362fbd11da34ceda4fcafcac0233eb764e471c7616a06102faf342
-
SSDEEP
49152:YaRR9t0mnFiz8aA4chhBBGm0uZPjErQfRhQPIyHdXBHNGmYLxaJzZj36QfbLKmxt:PZiA7BvZPjErQfRe9HdXBHNGmYLwJzh/
Malware Config
Extracted
alienbot
http://girisapi5698.pw
Extracted
alienbot
http://girisapi5698.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.matrix.loan1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD569183f45a49ce910fd079eb0c3137e51
SHA11f959588023c849efc22cc53af80f13157b1bb49
SHA256d9d3e1508775a281478aeb0961a077913d6d6389fa3c033c79f9d52d947c030a
SHA51265f193419a51097421dbe62d0886f755a55922b1d4759993bc6338c5f1e337e6f20ec15d5c97098c4a790ba8fada3941ee44ae105c9a412b246dc43f1244dd48
-
Filesize
238KB
MD5688ba7510f022d0194352001df848ca7
SHA1618880f3032c42be58d3f90dababb1724d091731
SHA256db5b8e862278eaca1568299cbeed3d5b21de8e065f76116988035239dc8808f2
SHA5123f39637bb8da82724ba793aebe16d9776d08e646031c480662328e9b3ae9d2b12945a7bf1991f748d26dab9886c9862121c7c1098ea79ee12d1d34b59f2e8333
-
Filesize
265B
MD5275dbd4c778fe9a0832cc3d47498b27a
SHA1f7f49f872440c5b881804ccd22d650d1ce08571d
SHA2560a22c6621a72612c3230e77ce03e9577ed7acca6a274172586f9eeac3e8b9166
SHA512f3f010fb374c0e2c211fd501e903d12229e70dd42bd760869806e9ccff7a83385bd87b2f6f20eb2af8e189c75ff61cf08cbe5b65d5b4c8942488bf05cd0e43d0
-
Filesize
392B
MD594a5778879f8f2327a5d152327a4d8ee
SHA1f053cf41d57500a54935d4a997ab4e1ba7bd9969
SHA256c7ad1a88619f29ba6300711adc0f74957bdbd533f9fe908237163b7e6e921ce2
SHA512567918561e1a38057ddcbc1cef237cb4011067c80cc3afcc39a9578a8c4cf258e0788d4eeec1446af28315c74190cb395d63e2ae8e772840ec5d4149f199431d
-
Filesize
483KB
MD5ca99eaadef4d10c4f8e632887a2efce2
SHA1252a8a270ff8702532f9f2b1e206e6c0ab2bd351
SHA25678c531f34a9290f28cbb7ba2fdbd7a92c9c3c8d217321a05a83a193eae5df488
SHA51230bc73b450c7eeee28f233ca70fafb90a1271d44fed124630b33c634db6491bde8b2789e78b64ca528481d832db4a36964feb6434dddc9872f21ceb42a571eb1