Overview

overview

10

Static

static

7

023401cb52...fc.apk

android-9-x86

10

023401cb52...fc.apk

android-10-x64

10

023401cb52...fc.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    1302724s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
  • submitted
    31-08-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc.apk

  • Size

    2.1MB

  • MD5

    f962f5880d51312dc97276cd17f35f63

  • SHA1

    e432cd2258dec9fd05470726e9648a7501839b3f

  • SHA256

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc

  • SHA512

    d146f9b8be9cad7e13730b4f70b7ed144b2bef7c783cd8728d73c5dfc7b09b64a3176f3e69bc4a3b6bad4aea558026d62f3deba6b6d88ab7192d22869020ef43

  • SSDEEP

    49152:Bn1jZ+H/ztKOsWzWg2aMy0J0801I/rfhLxxOaQRmDcl1dIpkJnR/59G:51kfztjsvN/hLPNQRiML9G

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

rc4.plain

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads the content of SMS inbox messages. 1 IoCs
    infostealer
  • Reads the content of outgoing SMS messages. 2 IoCs
    infostealer
  • Reads information about phone network operator.

Processes

  • com.update.layer
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Reads the content of SMS inbox messages.
    • Reads the content of outgoing SMS messages.
    PID:4847
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5015
      • getprop ro.miui.ui.version.name
        2⤵
          PID:5088
        • getprop ro.miui.ui.version.name
          2⤵
            PID:5153
          • getprop ro.miui.ui.version.name
            2⤵
              PID:5189
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5222
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5290
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5326

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/data/com.update.layer/app_DynamicOptDex/OPr.json
                  Filesize

                  238KB

                  MD5

                  68f3cd8b1a755b7d95db5d365f17be41

                  SHA1

                  e7fe149662d7abf0db23867bfb37614d13a5e46b

                  SHA256

                  df2ceee8c9d4d2c6a647124edd34be049d7d96c9214c804b5f199000e392ab4c

                  SHA512

                  644d3d6baf4e0a5bb83f353adbbf2d7ee642ccc6abad628d6e97ff5958b6e31991dbabf7d2521852d3d7a808945c0e3cdb17e368a16b190a3abbc4ef1e8de4f2

                  Download Submit

                • /data/data/com.update.layer/app_DynamicOptDex/OPr.json
                  Filesize

                  238KB

                  MD5

                  c109dd6eff0c0f53a5e5daccda39c6bd

                  SHA1

                  47808bf2b9fd7ddfeb3fc14ed1626ad98dc0c609

                  SHA256

                  2d5d2920efe76ba1ea12691ab8f02a7fba4bbeecf9d73df5592191de7d428d99

                  SHA512

                  f551c97248cc87804b733ea341b8bc86a4a146a347233a2d2efdd4901a70d45e6f7589acf14005c804f38107b52d8d11368ddcacf1d8155b4aab1cce677703e0

                  Download Submit

                • /data/data/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof
                  Filesize

                  451B

                  MD5

                  06614fdc6597ecc3e4a5f7c2edee7a8d

                  SHA1

                  4427c1e44f77e69707c384595b9438e570466f17

                  SHA256

                  f505c648b65c8e64cb5f963e6bf49e1864379008736c171578d581cbab9e0748

                  SHA512

                  c4d2c4df74f8be88c0fedd389af043dd18f606ec962de54dece43d6ea96b198556077dcb604d646764f676a458d4dd9f58ef263c9871482d21119f1ecbcf92cb

                  Download Submit

                • /data/data/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof
                  Filesize

                  525B

                  MD5

                  4082aab7e97149b9e0e7e9b254ea597e

                  SHA1

                  bf751e6e607d2c5d1d98dd19f75deeaaf5754acc

                  SHA256

                  9e9d5065c6c6d44c982cb28fdc8163f8e156a48b22c6748457b648b674365840

                  SHA512

                  fd2a2940f46e0c71666beef0a878c542e8a5524f85ec1961e6be35e28cb0eafe718d1d33a33649d989cdeadc3537a8d4e9d04bfdb77181181dc15545108e2ee6

                  Download Submit

                • /data/data/com.update.layer/app_apk/ring0.apk
                  Filesize

                  946KB

                  MD5

                  a73f108dc1b655252c7e45e5df04d4f6

                  SHA1

                  8459f380f7ef684e393c4408f7f4ee58c99147c4

                  SHA256

                  c34367f5395f513b8ee0dedcd5502aed69172e71004a80c1f896ca97e05f4f62

                  SHA512

                  8f84e47b367fb35a073a31cf41422edccbde99ee126cb37d2df0bddae5e8ca0f5df4d6221930548bfd216f583b2885485d764fd58f73d6a14b9a697b66c58dc4

                  Download Submit

                • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
                  Filesize

                  483KB

                  MD5

                  0cb0220dd8a1afab6c9d6edb350400b7

                  SHA1

                  3b82338663a83909b251293472b1c5b5dbdb3a67

                  SHA256

                  bac9a8616d99c9befb0594b99ab7b9c47074f2a4047f7c998b66fd00f38d0504

                  SHA512

                  78822ad33a457e5128181a411e6bb0ad9a9357d130205e58a1c39a122f3fa3aef9a91d0df446cc089bc70c2ad126797758bc19f910050c247a5b7265e63f0864

                  Download Submit