Analysis
-
max time kernel
1696922s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20230831-en -
resource tags
-
submitted
05/09/2023, 11:38
General
-
Target
c83e025b27b19399dcad71b0e40c3019.apk
-
Size
2.1MB
-
MD5
c83e025b27b19399dcad71b0e40c3019
-
SHA1
e24a30b603a7b469b968cb682d83cb67d37d7cdf
-
SHA256
2ce35170c58b4140a752bf67bf4d8c81d65a1cf49b0aa17a6f31f136bc1c85bd
-
SHA512
f4d35a5127e86c4634ebc95dcc03c6cf11bc5fbf07bbb2032903f60599d3d144eaa97360c089ed30ac394b7b6a93d091ca2de22fb5bb0648156b0187c6d0ac22
-
SSDEEP
49152:beeN09Xci53aEYXjUwmllgzi0J0801rBaXMwbocl1dIpkJWuO9QDenNOLjRx5j1:bJMj5KEUjNQ+MwKM6QENcZj1
Malware Config
Extracted
alienbot
http://79.110.62.44
Extracted
alienbot
http://79.110.62.44
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
com.acid.reason1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442B
MD5bd19eb842c72225953a33fde7e8c561d
SHA1f0b1e90bb150745bbd7aa2200ee1533544f16ffb
SHA25636540fc1bfe59761e77cc497b24084bace27a92b7deb94034fe502c0e574be65
SHA51252a9d43a3f5c49aa50d7803f75261db6723ec284e466bc9fbd5ed69272a669fdd358683d23ede67944769fa201b980132430f82d5a0052f40f830a3f984982ea
-
Filesize
238KB
MD55dcb0a0f9f1f623cc8b6251dfff7d34d
SHA1781c0325e19ec7c0f66a02092b9792a4afcd4731
SHA256adced2bbe4abdb32a80c43e91e27d05063b1265b5e7e18cf272fd9f632a16494
SHA51254b6a828071e110cc5140399ea40db33a90ccc023488e57020569c15efaeecd210aa5f31a1eac3553cae85fe656ac4d04ed7a1c99f897b85a09d076959975f43
-
Filesize
238KB
MD514f07669c9c283ff161b3ac3da7f83f0
SHA1b6afeace48c71f55adb3d06b53fca22ba55ff45f
SHA25612be5073538f5274f34922786093e2b3421d4f04d45427305d9af793a23b8b24
SHA512a668ed7dbb2a220a15e40ad7ee5abc4f453ec848bee3add533f96742ba9f7362b5b9a0f1f7aee06769febd87df48dffa135e8cf95fa47ae27a671bfe4ee91e16
-
Filesize
483KB
MD59d9f67d1b602d0b16bb44384931787f0
SHA168d01c93a7d832702703e26da65340f14bfb7f0f
SHA256213296cb2078e4c7510528764b819a079597983847e16b2c767f54849d4a5f6e
SHA512df36b8bc78d78b9d629498f273aab95e2ff4c161c329cf3f49931fce96aaf1056a42b677c5e969f29b168466a7244bb184f0dff81475d15a3a5996146395b556