Analysis
-
max time kernel
2252891s -
max time network
165s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
-
submitted
11-09-2023 22:01
General
-
Target
0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363.apk
-
Size
2.1MB
-
MD5
e40024f930c3f19b89b0f0639e3e048c
-
SHA1
44255903ab77c97c9de06e7a52921593cdb89483
-
SHA256
0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363
-
SHA512
326d8facbbd82b6eeac70a04ab5cbc3426a5e5242d4edf3dd49109e75742838cd0edb7e4018ca82321cc72f086fcff33d106805628d5f370df97fea5b70b0fcc
-
SSDEEP
49152:L6pmUQoDTrOiCFPA2gL0J0801VBUf2cRqcl1dIpkJ8Rp5/0xNew:1ULrOiCFAM2cyMy/0PR
Malware Config
Extracted
alienbot
http://limit-tanimlama.net
Extracted
alienbot
http://limit-tanimlama.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Removes its main activity from the application launcher 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.supply.oil1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD510a6e436b0bee31a9f2ed74b4d6a50b7
SHA10360f72ad2b82c42da703114162d8b4566613481
SHA256087fd075a58880efd16d03724740416bf331634a3bffce2af075172f709837fe
SHA5126b62579a92291baf3844eb4747eb2a05024f4283bb35906aa415b265b3f008a87a159c89890b1f7ba4789d87125c1e92c6fde75408209a3d1872f9b1b8c014e5
-
Filesize
238KB
MD5784200c45e8d5ec0e504d4e09cb8fc87
SHA1d4c2d36a6e328a28108cf4cdd3bae967f65369b3
SHA25605514060c89e27fae692115142f190dc10e39060d21a0e9523da6cf684d5a84f
SHA512476cbaa17406636f20cf23062c69902d57f0199a053e556cb15ad6f0c3b5722ab9b5ddf81b38b9cc2754c162b8050cd20a6250793af60507600c23dc35050a0c
-
Filesize
483KB
MD5013a804a457ce0c5e63f4003bd15c301
SHA11dd06b6d8465833e012c9cc070d63844b176ef6a
SHA2565ee7fd2974b8ba94491cd02575da34d60affe0228ae5a30ad478d820e0226663
SHA512a121e0a32bf0eebf9239b8e52d6efb1df4655c0c11314bf08620897431c1d297019caf4122acb73ced329552460770afcc4464d13199b928290b6180a3963fcb
-
Filesize
351B
MD57b17163393f288a6926929a76e3cf532
SHA11e63bbc8a195f45c77da4ccf2e47d0eb896a739e
SHA256aec7f5a47fdb652e8a68d2c3bae28ea0e4ab494720e043dfcda0d114891a5717
SHA512c9488e08fd996af26f53d598ac226e20005df9fd238d28fd70bc4454f5a96336066431dae2c1fce4ff25f5fb868c298945ab024a4761a3a8dc54fff22baeed1f
-
Filesize
946KB
MD5a73f108dc1b655252c7e45e5df04d4f6
SHA18459f380f7ef684e393c4408f7f4ee58c99147c4
SHA256c34367f5395f513b8ee0dedcd5502aed69172e71004a80c1f896ca97e05f4f62
SHA5128f84e47b367fb35a073a31cf41422edccbde99ee126cb37d2df0bddae5e8ca0f5df4d6221930548bfd216f583b2885485d764fd58f73d6a14b9a697b66c58dc4