Overview

overview

10

Static

static

7

023401cb52...JC.apk

android-9-x86

10

023401cb52...JC.apk

android-10-x64

10

023401cb52...JC.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    1364164s
  • max time network
    134s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
  • submitted
    01-09-2023 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc_JC.apk

  • Size

    2.1MB

  • MD5

    f962f5880d51312dc97276cd17f35f63

  • SHA1

    e432cd2258dec9fd05470726e9648a7501839b3f

  • SHA256

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc

  • SHA512

    d146f9b8be9cad7e13730b4f70b7ed144b2bef7c783cd8728d73c5dfc7b09b64a3176f3e69bc4a3b6bad4aea558026d62f3deba6b6d88ab7192d22869020ef43

  • SSDEEP

    49152:Bn1jZ+H/ztKOsWzWg2aMy0J0801I/rfhLxxOaQRmDcl1dIpkJnR/59G:51kfztjsvN/hLPNQRiML9G

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

rc4.plain

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 3 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.update.layer
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:4996
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5153
      • getprop ro.miui.ui.version.name
        2⤵
          PID:5231

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.update.layer/app_DynamicOptDex/OPr.json
        Filesize

        238KB

        MD5

        68f3cd8b1a755b7d95db5d365f17be41

        SHA1

        e7fe149662d7abf0db23867bfb37614d13a5e46b

        SHA256

        df2ceee8c9d4d2c6a647124edd34be049d7d96c9214c804b5f199000e392ab4c

        SHA512

        644d3d6baf4e0a5bb83f353adbbf2d7ee642ccc6abad628d6e97ff5958b6e31991dbabf7d2521852d3d7a808945c0e3cdb17e368a16b190a3abbc4ef1e8de4f2

        Download Submit

      • /data/data/com.update.layer/app_DynamicOptDex/OPr.json
        Filesize

        238KB

        MD5

        c109dd6eff0c0f53a5e5daccda39c6bd

        SHA1

        47808bf2b9fd7ddfeb3fc14ed1626ad98dc0c609

        SHA256

        2d5d2920efe76ba1ea12691ab8f02a7fba4bbeecf9d73df5592191de7d428d99

        SHA512

        f551c97248cc87804b733ea341b8bc86a4a146a347233a2d2efdd4901a70d45e6f7589acf14005c804f38107b52d8d11368ddcacf1d8155b4aab1cce677703e0

        Download Submit

      • /data/data/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof
        Filesize

        386B

        MD5

        ddd7e265fa51f38e14631e3f03e9c978

        SHA1

        30b54221232e3e93900d17309f56cce3241b1656

        SHA256

        c1718a70f09c591d30e748fe4aeba36a9e544aece2a375d0e2a9aeee1fb6897f

        SHA512

        9cc9d5af27a9199d4f4079a385436adc7d5c5cb8a150e77faff45d659ed4b03b065fe3d778ce3924ea1e4ef7d8bfc1035dbc749445e19e8f2aff0728c3839565

        Download Submit

      • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
        Filesize

        483KB

        MD5

        0cb0220dd8a1afab6c9d6edb350400b7

        SHA1

        3b82338663a83909b251293472b1c5b5dbdb3a67

        SHA256

        bac9a8616d99c9befb0594b99ab7b9c47074f2a4047f7c998b66fd00f38d0504

        SHA512

        78822ad33a457e5128181a411e6bb0ad9a9357d130205e58a1c39a122f3fa3aef9a91d0df446cc089bc70c2ad126797758bc19f910050c247a5b7265e63f0864

        Download Submit