Analysis
-
max time kernel
871106s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20230824-en -
resource tags
-
submitted
26-08-2023 22:06
General
-
Target
1b79a85c7baea1d71627c161fd562431ebcb54ac115387afafaae46b3e710f01.apk
-
Size
2.2MB
-
MD5
c808dde8c007e07e8ebea155dfa4a81f
-
SHA1
d3b314615f6b8d41de6a31711b97f92e1448ca67
-
SHA256
1b79a85c7baea1d71627c161fd562431ebcb54ac115387afafaae46b3e710f01
-
SHA512
0d6d0bc8c9692ae6ed22f9e85965ae77c5f04692b9f8645c4eaf0e5c7a8a9a24a2f6ffcd9849e879eefee662017abc7e491468c19aad51fb4d07d05d794cb7f6
-
SSDEEP
49152:r2hxQOLwvclyPQWKJ+xVbBITjEzQ/9mH1XdTN2Wc/xitPZbj2ILLdSsNuS9fcQ35:r2hzwUwiyNITjEzQ/oH1XdTN2Wc/otPf
Malware Config
Extracted
alienbot
http://girisapi5698.pw
Extracted
alienbot
http://girisapi5698.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.smoke.enjoy1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.smoke.enjoy/app_DynamicOptDex/YRqQ.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.smoke.enjoy/app_DynamicOptDex/oat/x86/YRqQ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5da4df5472ee7d60d375d7b2384532c09
SHA1883ceb91cc257d3a71ef28acde250f8782c43d62
SHA2561fe0a42d41dc23a2d69a256df4f28f10a68c611fdaef1814a748bc8bdc1f7d4f
SHA512d8a42b50e8c556208f8e9a230cccc6e72261163531c48c8b6e1c761c3ece7fcb7715600b5d509ebef31058c4b1bfe1c1f1d00769b3fc8905de9ce2eba54d97fa
-
Filesize
238KB
MD5ba1d00d2dead6aff09ca8868176c214a
SHA121a6b341a3d01604a31c59ba6970b23f7438fb96
SHA256d858c174a6c7c3ae2e4d57572a164e03dec4de8b1416863b046df4f8aa7c6285
SHA5127a21b9c0f1201d017be895eb7e0c830a8d371e55955ca7f89ceda3875dbceae460ca689b072830cd9ba78076b3efad312ea6c5a36d2678ebb5d49357eb8d59f3
-
Filesize
451B
MD5251a9d7058eb671143e887ede895f97f
SHA1ac7193b8ceb306593c411c7be2b7bb8a5ca7fbeb
SHA256d44ec86dc08d3e0e8d7573d3b1cbafbc18f1282b27cb9548a82cafd20c6fef74
SHA512ef989198421c1526f8e2789cf1d20c82606e7eeeb195787d6f1c4b82ebab366adc9748991c7d3608bd294936b560c94bd4872e77781434803226a0cf69332dcf
-
Filesize
483KB
MD509e1d2dad81094917e9c64168f3740a8
SHA1fd0ca499ab40112a0c4d4e6a8f49ad48703e6848
SHA2569cefe170eb2ea3f407ba609302cbcb9b6ba3f45dd40a51a38718a591badac1c5
SHA5129fe51b4ef7c658f31f74baa15a0c0e5a80fd72293a6531743483715ef02f79efc15d54a9a563956a47adbc59e5507f27755c29b273f47610aeeb34ad3da8d792
-
Filesize
483KB
MD516cbed5f379e2684d42d83d908b86cd6
SHA114479585b1b6d0be1396534eef0def542cba36e0
SHA25677d9296b571198d2093db4d25c5420f59ef5163e7e48e7edc27c1d7c5f487c37
SHA5124d20146087daf65cd7902a40d38cda71af94c76608d7cb37df03b62c173c6db50ab8b0c3991cd8ea1bfcafed2d63d8f2384f7a6a66b749e2380d592b72447a06