Overview

overview

10

Static

static

7

5d1db00b48...a0.apk

android-9-x86

10

5d1db00b48...a0.apk

android-10-x64

10

5d1db00b48...a0.apk

android-11-x64

10

closebutton.html

windows7-x64

1

closebutton.html

windows10-2004-x64

1

core_wrapper.js

windows7-x64

1

core_wrapper.js

windows10-2004-x64

1

lynx_core.js

windows7-x64

1

lynx_core.js

windows10-2004-x64

1

nd

ubuntu-18.04-amd64

slardar_bridge.js

windows7-x64

1

slardar_bridge.js

windows10-2004-x64

1

slardar_sdk.js

windows7-x64

1

slardar_sdk.js

windows10-2004-x64

1

template.js

windows7-x64

1

template.js

windows10-2004-x64

1

Analysis

  • max time kernel
    784176s
  • max time network
    129s
  • platform
    android_x86
  • resource
    android-x86-arm-20230824-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230824-enlocale:en-usos:android-9-x86system
  • submitted
    25-08-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5d1db00b48f6bc240ede17b8a92d1eebd4d5400f60ffb272976364cd341054a0.apk

  • Size

    2.2MB

  • MD5

    0e920c52bcbb2e2edf8eda79d9b041a2

  • SHA1

    73d6992c1ff73325bf768bca25526157c9a9420c

  • SHA256

    5d1db00b48f6bc240ede17b8a92d1eebd4d5400f60ffb272976364cd341054a0

  • SHA512

    2bd973f64d377a25b6f18aaaee1249c9f4d9701a72e5f27a6d6dcb721e5288b119161d003fc863b7f74be9f06d698276f1506e997e60c98865805a51acb0e869

  • SSDEEP

    49152:g/mJkKqsduCfSWibt7gbx2X4oj5mNjE+QjLBHNXryNw8fOkcEYZuKVhTNORRopSE:g/DKqq9fSpJsVirmNjE+Qj1HNXryNw8Q

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://girisapi5698.pw

rc4.plain

Extracted

Family

alienbot

C2

http://girisapi5698.pw

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.false.degree
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4193
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.false.degree/app_DynamicOptDex/nQskRt.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.false.degree/app_DynamicOptDex/oat/x86/nQskRt.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4219

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.false.degree/app_DynamicOptDex/nQskRt.json
    Filesize

    238KB

    MD5

    e4af42f6db2cb07d590b1cdf33c163fb

    SHA1

    ab0f197a9b67cf8fdc142f11fb0f0f201269f89e

    SHA256

    c4e3139f185da34a6e6b85c3c1b6fe715e92086189776dc5c809c215df361238

    SHA512

    79f02e653ada984a8c1c0e0bfe8f7aef2d8d79cb3504979d16022cdbcb5dea3d0e28ce4dd4366f0e4727334a3875aa7b2246e86e04509f52808884ada4c90d75

    Download Submit

  • /data/data/com.false.degree/app_DynamicOptDex/nQskRt.json
    Filesize

    238KB

    MD5

    183d9219d93b50221d37219080b08792

    SHA1

    a389c867780fbd626f29e5f31fb133fa3ead6f27

    SHA256

    72d4aad82e849789360549dbd59f2e0d8ea7e70e9979fa03f3f6a082694f418c

    SHA512

    ccfd6f42bd8e00a7d9a084849e6e534795371e950039a2fa5552006999048773b27c6a9d4be075913b7fc1deffadfae87aeff7b0d23088be7073b22ae6766adb

    Download Submit

  • /data/data/com.false.degree/app_DynamicOptDex/oat/nQskRt.json.cur.prof
    Filesize

    467B

    MD5

    e99817666ca6f8a20fe31403fe05faed

    SHA1

    b144441d51e68650dd9be5684014f70f562e47bf

    SHA256

    24cf89d9695041a6e6c7a8a42eff6fb749f18c639ccda8e427f77d415b5592f2

    SHA512

    02d115f6c26a70bd7078dec50f504ef63197fcb9013ef159948c6638c41d47b2a69fb0f8ab62559d545abb1e4aaf65ece457defd7586c4a1a3a5b16265296aa3

    Download Submit

  • /data/user/0/com.false.degree/app_DynamicOptDex/nQskRt.json
    Filesize

    483KB

    MD5

    5e9f2dcfaeffdcf00c71afb33a10c597

    SHA1

    27fa0cb59383d1f93343979be2e3a00b66c69e30

    SHA256

    3a57678876470182a6373c330cd71ae6408c5f315eb56641c146cf3fe226660a

    SHA512

    4b9643684c568fec47a6a3038cbf1e9d7004ddd8a9fc43d55398d7f0009dfe2ef7b7c124e8d4ba74c31758edc29484947161d735e0b35b63d4c4284d2fa1df4e

    Download Submit

  • /data/user/0/com.false.degree/app_DynamicOptDex/nQskRt.json
    Filesize

    483KB

    MD5

    ca99eaadef4d10c4f8e632887a2efce2

    SHA1

    252a8a270ff8702532f9f2b1e206e6c0ab2bd351

    SHA256

    78c531f34a9290f28cbb7ba2fdbd7a92c9c3c8d217321a05a83a193eae5df488

    SHA512

    30bc73b450c7eeee28f233ca70fafb90a1271d44fed124630b33c634db6491bde8b2789e78b64ca528481d832db4a36964feb6434dddc9872f21ceb42a571eb1

    Download Submit