Overview

overview

10

Static

static

7

505e9fa346...2a.apk

android-9-x86

10

505e9fa346...2a.apk

android-10-x64

10

505e9fa346...2a.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    2343408s
  • max time network
    158s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
  • submitted
    12-09-2023 23:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    505e9fa3460095e7424ca5e4fa7f77fd97e7062c6467edcc5253bbf3c296b02a.apk

  • Size

    2.1MB

  • MD5

    75d203d2f8068d1407b06d6ef4328d26

  • SHA1

    6341fbe817f2a6004dd24a84806983f71bb14585

  • SHA256

    505e9fa3460095e7424ca5e4fa7f77fd97e7062c6467edcc5253bbf3c296b02a

  • SHA512

    e141ce097bb9e5e3262d91111aa9647b5a53ad67415f0baed299393c8dc493ebbe7189508fdc532889bff87df6c2febad0e77d71ea2d2013c6945c3be56f913c

  • SSDEEP

    49152:zM/MezoBZCPqBLMKLFZzVBN0J0801tJ0bCETc5uFycl1dIpkJMRV5z+:4zgQiLLZzQCBESMyz+

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://arti-limit.net

rc4.plain

Extracted

Family

alienbot

C2

http://arti-limit.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.tobacco.gossip
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4172
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tobacco.gossip/app_DynamicOptDex/oat/x86/DHxjWo.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4198

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
    Filesize

    238KB

    MD5

    9f8b3ed7b61e3cede73c66fce0acc66e

    SHA1

    bb208cc812188fd76ddfb6b285ed5e9b461d708d

    SHA256

    99b9ea699a2e13dc0808b46dd218eee3b6673b002e6649167e0c5c9eafa8d22d

    SHA512

    bfd564fde6573fb189d2dce2429b2f4c3531b9ccc6ea5e1b9eeea2b693c6aded532eb1abd594e5aa63bf3a51529ba92b5c450c424373e057b5457d3758292f19

    Download Submit

  • /data/data/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
    Filesize

    238KB

    MD5

    816d316dd3655942bb366fd5865e3bdd

    SHA1

    a7838828456b38ee422470af127ab77389ba4aec

    SHA256

    472c8653babd2bc423ed47e752f3d50c251863e1bd0382e606065272c2a77018

    SHA512

    0b31ae06626546f5ed3c9bfb2a72cf3a07779815fd33ee9dc19e2917a3cb69ba11e454632a223a6296ea837ee34888eb51293a2584b750103c55350dbd57a584

    Download Submit

  • /data/data/com.tobacco.gossip/app_DynamicOptDex/oat/DHxjWo.json.cur.prof
    Filesize

    487B

    MD5

    1c48eb7718f66dc6f411b771cd85457a

    SHA1

    0a752a2ccb916cbf18b2c5b81b08011593ed1b59

    SHA256

    e36a82878344be8b95bd7ec74a210174ceca7030715f298e4796a4bdf5da1c12

    SHA512

    9716e1e55a13313d9461b38f94416c5266e349c15f4d4629e5b44e95564c75594c842bb956cf7b49f577b885df90fba2f7f71cec7876f0cf3200e300563f588f

    Download Submit

  • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
    Filesize

    483KB

    MD5

    d5dc6aca3d5d42128dbefc7f01b337ff

    SHA1

    2b4c8ff8b4dde5b9e0d48609e316a41925909eea

    SHA256

    3eab2c921505725ea021d27fb08e73e9cf4f2aa35594d2bff34e14c7e317cc89

    SHA512

    2386cd954a7d504acc71c4aebcee77d69bf54fab08b0eb0ac993a6e6b9b6c51884ad11f992d5f2e8489aef5cfea8aef40d5f49734375064417866951a900f481

    Download Submit

  • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
    Filesize

    483KB

    MD5

    8eef9936c65a15f444235238e6cc07ca

    SHA1

    c2bd026518fdb59efb5cf374a5eabb3029c12148

    SHA256

    ff4cf0596760c84aebb83ca5b0dad1e1ba9bc4dfde40550ef726521b773a31f7

    SHA512

    cefc5e056d91423d1b81423c08d56a031a724d5ac2b76b1b5c42836bf71777edaf2440f5045dd9146460a2f7b90848a3ef8c0b312f740d4cf57437ffec5f662b

    Download Submit