Overview

overview

10

Static

static

7

023401cb52...JC.apk

android-9-x86

10

023401cb52...JC.apk

android-10-x64

10

023401cb52...JC.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    1364174s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    01-09-2023 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc_JC.apk

  • Size

    2.1MB

  • MD5

    f962f5880d51312dc97276cd17f35f63

  • SHA1

    e432cd2258dec9fd05470726e9648a7501839b3f

  • SHA256

    023401cb52793c28925cd213f4c8ef48cef18b904cfcee01880cb219f8844cfc

  • SHA512

    d146f9b8be9cad7e13730b4f70b7ed144b2bef7c783cd8728d73c5dfc7b09b64a3176f3e69bc4a3b6bad4aea558026d62f3deba6b6d88ab7192d22869020ef43

  • SSDEEP

    49152:Bn1jZ+H/ztKOsWzWg2aMy0J0801I/rfhLxxOaQRmDcl1dIpkJnR/59G:51kfztjsvN/hLPNQRiML9G

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

rc4.plain

Extracted

Family

alienbot

C2

http://dijitalgirisbigi.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.update.layer
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4615
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4737
      • getprop ro.miui.ui.version.name
        2⤵
          PID:4827
        • getprop ro.miui.ui.version.name
          2⤵
            PID:4980
          • getprop ro.miui.ui.version.name
            2⤵
              PID:5013
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5040
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5090
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5125

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
                  Filesize

                  238KB

                  MD5

                  68f3cd8b1a755b7d95db5d365f17be41

                  SHA1

                  e7fe149662d7abf0db23867bfb37614d13a5e46b

                  SHA256

                  df2ceee8c9d4d2c6a647124edd34be049d7d96c9214c804b5f199000e392ab4c

                  SHA512

                  644d3d6baf4e0a5bb83f353adbbf2d7ee642ccc6abad628d6e97ff5958b6e31991dbabf7d2521852d3d7a808945c0e3cdb17e368a16b190a3abbc4ef1e8de4f2

                  Download Submit

                • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
                  Filesize

                  238KB

                  MD5

                  c109dd6eff0c0f53a5e5daccda39c6bd

                  SHA1

                  47808bf2b9fd7ddfeb3fc14ed1626ad98dc0c609

                  SHA256

                  2d5d2920efe76ba1ea12691ab8f02a7fba4bbeecf9d73df5592191de7d428d99

                  SHA512

                  f551c97248cc87804b733ea341b8bc86a4a146a347233a2d2efdd4901a70d45e6f7589acf14005c804f38107b52d8d11368ddcacf1d8155b4aab1cce677703e0

                  Download Submit

                • /data/user/0/com.update.layer/app_DynamicOptDex/OPr.json
                  Filesize

                  483KB

                  MD5

                  0cb0220dd8a1afab6c9d6edb350400b7

                  SHA1

                  3b82338663a83909b251293472b1c5b5dbdb3a67

                  SHA256

                  bac9a8616d99c9befb0594b99ab7b9c47074f2a4047f7c998b66fd00f38d0504

                  SHA512

                  78822ad33a457e5128181a411e6bb0ad9a9357d130205e58a1c39a122f3fa3aef9a91d0df446cc089bc70c2ad126797758bc19f910050c247a5b7265e63f0864

                  Download Submit

                • /data/user/0/com.update.layer/app_DynamicOptDex/oat/OPr.json.cur.prof
                  Filesize

                  315B

                  MD5

                  e56f4206f877d7f1a80a1419e975614e

                  SHA1

                  def224324a6900920e9f8a9ebeb283a954078ac3

                  SHA256

                  aefc7b0f7dbd70ac29be85626b49708fa402122062b5b37628f49d6d8fdc0542

                  SHA512

                  0ea7fbedd758e8394a2310dd740046157852f856eef3d772073d5071723233688df1d247b2d643d3d5ef8cbaf8184b6bc0987ae6728b3ee0ef1c9db46958242c

                  Download Submit