Overview

overview

10

Static

static

7

023401cb52...JC.apk

android-9-x86

10

023401cb52...JC.apk

android-10-x64

10

023401cb52...JC.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    1364168s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
  • submitted
    01-09-2023 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc_JC.apk

  • Size

    2.1MB

  • MD5

    f962f5880d51312dc97276cd17f35f63

  • SHA1

    e432cd2258dec9fd05470726e9648a7501839b3f

  • SHA256

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc

  • SHA512

    d146f9b8be9cad7e13730b4f70b7ed144b2bef7c783cd8728d73c5dfc7b09b64a3176f3e69bc4a3b6bad4aea558026d62f3deba6b6d88ab7192d22869020ef43

  • SSDEEP

    49152:Bn1jZ+H/ztKOsWzWg2aMy0J0801I/rfhLxxOaQRmDcl1dIpkJnR/59G:51kfztjsvN/hLPNQRiML9G

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

rc4.plain

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.update.layer
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4170
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.update.layer/app_DynamicOptDex/OPr.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.update.layer/app_DynamicOptDex/oat/x86/OPr.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.update.layer/app_DynamicOptDex/OPr.json
    Filesize

    238KB

    MD5

    68f3cd8b1a755b7d95db5d365f17be41

    SHA1

    e7fe149662d7abf0db23867bfb37614d13a5e46b

    SHA256

    df2ceee8c9d4d2c6a647124edd34be049d7d96c9214c804b5f199000e392ab4c

    SHA512

    644d3d6baf4e0a5bb83f353adbbf2d7ee642ccc6abad628d6e97ff5958b6e31991dbabf7d2521852d3d7a808945c0e3cdb17e368a16b190a3abbc4ef1e8de4f2

    Download Submit

  • /data/data/com.update.layer/app_DynamicOptDex/OPr.json
    Filesize

    238KB

    MD5

    c109dd6eff0c0f53a5e5daccda39c6bd

    SHA1

    47808bf2b9fd7ddfeb3fc14ed1626ad98dc0c609

    SHA256

    2d5d2920efe76ba1ea12691ab8f02a7fba4bbeecf9d73df5592191de7d428d99

    SHA512

    f551c97248cc87804b733ea341b8bc86a4a146a347233a2d2efdd4901a70d45e6f7589acf14005c804f38107b52d8d11368ddcacf1d8155b4aab1cce677703e0

    Download Submit

  • /data/data/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof
    Filesize

    479B

    MD5

    26dbc109d5f2042dbeaf0ddd0bee8ca7

    SHA1

    7723681b4676179cbdb7647a78dc3c52d3c12946

    SHA256

    6011ff6c1f838f172abba9f4860e1879de3d6b98b4b90e8873e97f143e5907e6

    SHA512

    b161597b8bf73fca14442668dc567bc4133acd27806b35a5c94436d49c7492a77eff62e6c0f8db7892527456e718f8fde7ff1436868960514951fcc4ecf4479d

    Download Submit

  • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
    Filesize

    483KB

    MD5

    b2937c219f63af4d51fc860cb4a82a85

    SHA1

    7c78c6c344fbfe45a34b85aee96cdd40581e3485

    SHA256

    bfbc4bc27b9e1b9747537f013c3781f66721086bfe24c9e3c5c817f469b5b710

    SHA512

    a1c8700fca781b17b603f5f5634564b6848c17ab7c2304f14ddf9fd666e6d884f0288003e7a923062549a5b6d7f3114593e5ade0221325584f9e329f7d3b1399

    Download Submit

  • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
    Filesize

    483KB

    MD5

    0cb0220dd8a1afab6c9d6edb350400b7

    SHA1

    3b82338663a83909b251293472b1c5b5dbdb3a67

    SHA256

    bac9a8616d99c9befb0594b99ab7b9c47074f2a4047f7c998b66fd00f38d0504

    SHA512

    78822ad33a457e5128181a411e6bb0ad9a9357d130205e58a1c39a122f3fa3aef9a91d0df446cc089bc70c2ad126797758bc19f910050c247a5b7265e63f0864

    Download Submit