Overview

overview

10

Static

static

7

505e9fa346...2a.apk

android-9-x86

10

505e9fa346...2a.apk

android-10-x64

10

505e9fa346...2a.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    2343409s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
  • submitted
    12-09-2023 23:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    505e9fa3460095e7424ca5e4fa7f77fd97e7062c6467edcc5253bbf3c296b02a.apk

  • Size

    2.1MB

  • MD5

    75d203d2f8068d1407b06d6ef4328d26

  • SHA1

    6341fbe817f2a6004dd24a84806983f71bb14585

  • SHA256

    505e9fa3460095e7424ca5e4fa7f77fd97e7062c6467edcc5253bbf3c296b02a

  • SHA512

    e141ce097bb9e5e3262d91111aa9647b5a53ad67415f0baed299393c8dc493ebbe7189508fdc532889bff87df6c2febad0e77d71ea2d2013c6945c3be56f913c

  • SSDEEP

    49152:zM/MezoBZCPqBLMKLFZzVBN0J0801tJ0bCETc5uFycl1dIpkJMRV5z+:4zgQiLLZzQCBESMyz+

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://arti-limit.net

rc4.plain

Extracted

Family

alienbot

C2

http://arti-limit.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 3 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.tobacco.gossip
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:5007
    • getprop ro.miui.ui.version.name
      2⤵
        PID:5166
      • getprop ro.miui.ui.version.name
        2⤵
          PID:5249

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
        Filesize

        238KB

        MD5

        9f8b3ed7b61e3cede73c66fce0acc66e

        SHA1

        bb208cc812188fd76ddfb6b285ed5e9b461d708d

        SHA256

        99b9ea699a2e13dc0808b46dd218eee3b6673b002e6649167e0c5c9eafa8d22d

        SHA512

        bfd564fde6573fb189d2dce2429b2f4c3531b9ccc6ea5e1b9eeea2b693c6aded532eb1abd594e5aa63bf3a51529ba92b5c450c424373e057b5457d3758292f19

        Download Submit

      • /data/data/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
        Filesize

        238KB

        MD5

        816d316dd3655942bb366fd5865e3bdd

        SHA1

        a7838828456b38ee422470af127ab77389ba4aec

        SHA256

        472c8653babd2bc423ed47e752f3d50c251863e1bd0382e606065272c2a77018

        SHA512

        0b31ae06626546f5ed3c9bfb2a72cf3a07779815fd33ee9dc19e2917a3cb69ba11e454632a223a6296ea837ee34888eb51293a2584b750103c55350dbd57a584

        Download Submit

      • /data/data/com.tobacco.gossip/app_DynamicOptDex/oat/DHxjWo.json.cur.prof
        Filesize

        395B

        MD5

        d88bec2016dd4eaac4fbfeacf8668b4e

        SHA1

        985c059f76bb0b66e82c1615ecfea5d2de49458d

        SHA256

        1936e41399d7e0addd0369da0ef5363236a5f85f46c56142e814a4a19605d943

        SHA512

        7fec674b316dbf71cadba17e8e5d34c88cd07a6e568d1edf0669d5dc90a3f0cb64cb3101492e9e69b132ba0997489e3b946c59d3447dd20fbd310cedb3d396b1

        Download Submit

      • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
        Filesize

        483KB

        MD5

        8eef9936c65a15f444235238e6cc07ca

        SHA1

        c2bd026518fdb59efb5cf374a5eabb3029c12148

        SHA256

        ff4cf0596760c84aebb83ca5b0dad1e1ba9bc4dfde40550ef726521b773a31f7

        SHA512

        cefc5e056d91423d1b81423c08d56a031a724d5ac2b76b1b5c42836bf71777edaf2440f5045dd9146460a2f7b90848a3ef8c0b312f740d4cf57437ffec5f662b

        Download Submit