Analysis
-
max time kernel
784509s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20230824-en -
resource tags
-
submitted
25-08-2023 22:04
General
-
Target
e4f2b421efed01a77093b45d8dd08d08229bbe69ae1f07c315aba7c532582c3f.apk
-
Size
2.2MB
-
MD5
8f3f60d13595c075d79f05473938b605
-
SHA1
4c95b3ea30d7085e3853c79f380f31414989eb19
-
SHA256
e4f2b421efed01a77093b45d8dd08d08229bbe69ae1f07c315aba7c532582c3f
-
SHA512
c686edd3e04b0ebef54d99217ecd0426dc6411e40a24fd79dada8244aaf4af5dbedd69db940754e746def74f18ab047c45135b03f6272e296479a35e7b2ed8d1
-
SSDEEP
49152:pYsQyeWzMkH0UHtUrkJmJjEgQH7jHdXfYNMYxgywlTZD4yyXuBCe21WkD/zGK1zp:OZyeWzGUHCrkJmJjEgQHXHdXfYNMYxgw
Malware Config
Extracted
alienbot
http://girisapi5698.pw
Extracted
alienbot
http://girisapi5698.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.inherit.month1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381B
MD5d03fd7850a3cf9a8e10e4d4ca5276835
SHA163fceccaa5e9afef2b7135949a7ee4585a9f1880
SHA256dcbf28ea457aad9bd3fb8249ef5b8f5bc562228d5d40b135a16be32872436443
SHA51221edafeacf6b872dc99b689554520a6651fb0347295f4b516d25e8ebd31388cb6bb0a5fcce44a1fa3a77a3ccee717bb05ca569fae52214b9034485a5bbc4068f
-
Filesize
238KB
MD5af15f64953415122a1abf82af7342f50
SHA196cd7fd0583749fccbc2827b8c2108364c3a0083
SHA2566ff807f3b430a1b40fc01f0caf07e7321a21f15828fc476c8b22a375806e58de
SHA512b7fe17732040b5d3acc11a1c238e5ed2af1d33b2f605a20b2ba8828f86533fa01faff067276f4af220dd750125ccebeae89ebac6065d72e99423dcaf07356a47
-
Filesize
238KB
MD5dbab4dee1fe44a72c2788e400428ac85
SHA11746a8aa9886255d2d71dd597b1be54d35cfde5b
SHA25677fc7bf36df11ca27741918144bee2115ea527bf1abec11bfc09ec55714db0f2
SHA512018966be3705a8660d3a0b02c107c5771c3f72731afc031cb7d2c6a5bda2ba333d973866b77b99a77d34d529883591582e79313f0b20b1c752b5053748a968ad
-
Filesize
483KB
MD516cbed5f379e2684d42d83d908b86cd6
SHA114479585b1b6d0be1396534eef0def542cba36e0
SHA25677d9296b571198d2093db4d25c5420f59ef5163e7e48e7edc27c1d7c5f487c37
SHA5124d20146087daf65cd7902a40d38cda71af94c76608d7cb37df03b62c173c6db50ab8b0c3991cd8ea1bfcafed2d63d8f2384f7a6a66b749e2380d592b72447a06