Analysis
-
max time kernel
871105s -
max time network
141s -
platform
android_x64 -
resource
android-x64-20230824-en -
resource tags
-
submitted
26-08-2023 22:06
General
-
Target
1b79a85c7baea1d71627c161fd562431ebcb54ac115387afafaae46b3e710f01.apk
-
Size
2.2MB
-
MD5
c808dde8c007e07e8ebea155dfa4a81f
-
SHA1
d3b314615f6b8d41de6a31711b97f92e1448ca67
-
SHA256
1b79a85c7baea1d71627c161fd562431ebcb54ac115387afafaae46b3e710f01
-
SHA512
0d6d0bc8c9692ae6ed22f9e85965ae77c5f04692b9f8645c4eaf0e5c7a8a9a24a2f6ffcd9849e879eefee662017abc7e491468c19aad51fb4d07d05d794cb7f6
-
SSDEEP
49152:r2hxQOLwvclyPQWKJ+xVbBITjEzQ/9mH1XdTN2Wc/xitPZbj2ILLdSsNuS9fcQ35:r2hzwUwiyNITjEzQ/oH1XdTN2Wc/otPf
Malware Config
Extracted
alienbot
http://girisapi5698.pw
Extracted
alienbot
http://girisapi5698.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 5 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
com.smoke.enjoy1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5da4df5472ee7d60d375d7b2384532c09
SHA1883ceb91cc257d3a71ef28acde250f8782c43d62
SHA2561fe0a42d41dc23a2d69a256df4f28f10a68c611fdaef1814a748bc8bdc1f7d4f
SHA512d8a42b50e8c556208f8e9a230cccc6e72261163531c48c8b6e1c761c3ece7fcb7715600b5d509ebef31058c4b1bfe1c1f1d00769b3fc8905de9ce2eba54d97fa
-
Filesize
238KB
MD5ba1d00d2dead6aff09ca8868176c214a
SHA121a6b341a3d01604a31c59ba6970b23f7438fb96
SHA256d858c174a6c7c3ae2e4d57572a164e03dec4de8b1416863b046df4f8aa7c6285
SHA5127a21b9c0f1201d017be895eb7e0c830a8d371e55955ca7f89ceda3875dbceae460ca689b072830cd9ba78076b3efad312ea6c5a36d2678ebb5d49357eb8d59f3
-
Filesize
432B
MD507b66bbd6dbb557b1bd0c0fd24b6c944
SHA1e2ea507799791e94351195961a4947d76c2b6e75
SHA2562dfe5e50ad28435e837d4dcf322a0fe82757ccf0dd094163d2c951d15e4c8bf6
SHA5122cec21a91d6a97a8975975f69d8992981996a411b22fd0bc81a5a861b64c2383ee92c775e9fc049a42e0619d52f9c9752a605d4120f2d6bb1684aeeed36d6ad0
-
Filesize
483KB
MD516cbed5f379e2684d42d83d908b86cd6
SHA114479585b1b6d0be1396534eef0def542cba36e0
SHA25677d9296b571198d2093db4d25c5420f59ef5163e7e48e7edc27c1d7c5f487c37
SHA5124d20146087daf65cd7902a40d38cda71af94c76608d7cb37df03b62c173c6db50ab8b0c3991cd8ea1bfcafed2d63d8f2384f7a6a66b749e2380d592b72447a06