Overview

overview

10

Static

static

7

baef3c30e6...ed.apk

android-9-x86

10

baef3c30e6...ed.apk

android-10-x64

10

baef3c30e6...ed.apk

android-11-x64

10

AboutCompat.js

windows7-x64

1

AboutCompat.js

windows10-2004-x64

1

PinDialog.html

windows7-x64

1

PinDialog.html

windows10-2004-x64

1

StatusInfo.html

windows7-x64

1

StatusInfo.html

windows10-2004-x64

1

WebviewSocket.html

windows7-x64

1

WebviewSocket.html

windows10-2004-x64

1

aboutCompat.html

windows7-x64

1

aboutCompat.html

windows10-2004-x64

1

aboutCompat.js

windows7-x64

1

aboutCompat.js

windows10-2004-x64

1

aboutPage.js

windows7-x64

1

aboutPage.js

windows10-2004-x64

1

aboutPageP...ipt.js

windows7-x64

1

aboutPageP...ipt.js

windows10-2004-x64

1

about_comp...ker.js

windows7-x64

1

about_comp...ker.js

windows10-2004-x64

1

ads.js

windows7-x64

1

ads.js

windows10-2004-x64

1

adsafeprot...ima.js

windows7-x64

1

adsafeprot...ima.js

windows10-2004-x64

1

background.js

windows7-x64

1

background.js

windows10-2004-x64

1

bmauth.js

windows7-x64

1

bmauth.js

windows10-2004-x64

1

bootstrap.js

windows7-x64

1

bootstrap.js

windows10-2004-x64

1

codemirror...min.js

windows7-x64

1

Analysis

  • max time kernel
    1902216s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
  • submitted
    07-09-2023 20:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded.apk

  • Size

    2.8MB

  • MD5

    3de95c460ac3a94c42d8b24837ba90c3

  • SHA1

    31fa866184468d24760a25db57fec72ca71a9618

  • SHA256

    baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded

  • SHA512

    41381d60c9cfbdda55eee351cb2b5d835f27964fee53893fdc77b7e80b3616dc171efe2d2fa86dddd9789bc37bd4d937c394c4d09bfa08e2d5fa208e3367c7b7

  • SSDEEP

    49152:CfBFCzfQ5Jo2+8KZmsuvgFR5/FFTF+0wupmPH3Fg7ku0HP4JV0MulHQEutc7Y:s00zKZmLvgbhZouY3a7k7vQuMu9QEutv

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://uniquebbs.asia

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • slow.energy.impose
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    PID:4974
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5132
      • getprop ro.miui.ui.version.name
        2⤵
          PID:5215
        • getprop ro.miui.ui.version.name
          2⤵
            PID:5347
          • getprop ro.miui.ui.version.name
            2⤵
              PID:5382
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5417
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5453
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5480

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/data/slow.energy.impose/app_DynamicOptDex/AENm.json
                  Filesize

                  640KB

                  MD5

                  000d090ab5b6cfffd7b421faeade73ba

                  SHA1

                  c26546d6326c907390f3143513e302b6bfd91a38

                  SHA256

                  928303543157a10a22f331328bc762c25a86f20b3b798cb75b04da5bc275347d

                  SHA512

                  0218849392fff7cd018cee5249998951628340376b9da598ac859dc825d49067afbbb2a00691cac47d7b140515cac65d27aa176dcce912dbda3de28a5271b672

                  Download Submit

                • /data/data/slow.energy.impose/app_DynamicOptDex/AENm.json
                  Filesize

                  640KB

                  MD5

                  e9f35065ec679555c38c8f35d3a3ab21

                  SHA1

                  7a100651d596e25b9254d56b16da7bd094cbf7ba

                  SHA256

                  ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

                  SHA512

                  2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

                  Download Submit

                • /data/data/slow.energy.impose/app_DynamicOptDex/oat/AENm.json.cur.prof
                  Filesize

                  450B

                  MD5

                  6013b811cffae64dd28f95e8d14bcaaf

                  SHA1

                  c434aaf1030dc30b578dc6a3a28361635ba5ae8f

                  SHA256

                  f421ed5280147cc1f7bbd8df5e2acb56948a1573f07edb2f84e568b3ffe6d781

                  SHA512

                  b86dc4f36adef7167e67572c36f384bdf0c60a650ff8780dc28766cc08e3358cd1fdd134a9a274ba1d2ad08f294e4aaaed6b8ab00b34239da9ff24501959c759

                  Download Submit

                • /data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json
                  Filesize

                  640KB

                  MD5

                  e9f35065ec679555c38c8f35d3a3ab21

                  SHA1

                  7a100651d596e25b9254d56b16da7bd094cbf7ba

                  SHA256

                  ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

                  SHA512

                  2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

                  Download Submit

                • /data/user/0/slow.energy.impose/app_DynamicOptDex/AENm.json
                  Filesize

                  640KB

                  MD5

                  e9f35065ec679555c38c8f35d3a3ab21

                  SHA1

                  7a100651d596e25b9254d56b16da7bd094cbf7ba

                  SHA256

                  ebfb1a0df4ec7a347a6a4074cfcb2c9fd13ba4de7bbe1bc87dc8d1b2ab2f2199

                  SHA512

                  2736532eb3a10a382ce920ad0bdf8539d427cc3160732ed5e8ae05d1908a968c6ae9c633a1f458b993d05afd8f9c8e76c6c3ccea5b86b97cc7a45c957d0bec2f

                  Download Submit