Overview

overview

10

Static

static

7

505e9fa346...2a.apk

android-9-x86

10

505e9fa346...2a.apk

android-10-x64

10

505e9fa346...2a.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    2343417s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    12-09-2023 23:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    505e9fa3460095e7424ca5e4fa7f77fd97e7062c6467edcc5253bbf3c296b02a.apk

  • Size

    2.1MB

  • MD5

    75d203d2f8068d1407b06d6ef4328d26

  • SHA1

    6341fbe817f2a6004dd24a84806983f71bb14585

  • SHA256

    505e9fa3460095e7424ca5e4fa7f77fd97e7062c6467edcc5253bbf3c296b02a

  • SHA512

    e141ce097bb9e5e3262d91111aa9647b5a53ad67415f0baed299393c8dc493ebbe7189508fdc532889bff87df6c2febad0e77d71ea2d2013c6945c3be56f913c

  • SSDEEP

    49152:zM/MezoBZCPqBLMKLFZzVBN0J0801tJ0bCETc5uFycl1dIpkJMRV5z+:4zgQiLLZzQCBESMyz+

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://arti-limit.net

rc4.plain

Extracted

Family

alienbot

C2

http://arti-limit.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.tobacco.gossip
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4558
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4696
      • getprop ro.miui.ui.version.name
        2⤵
          PID:4822
        • getprop ro.miui.ui.version.name
          2⤵
            PID:4933
          • getprop ro.miui.ui.version.name
            2⤵
              PID:4973
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5013
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5044
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5069

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
                  Filesize

                  238KB

                  MD5

                  9f8b3ed7b61e3cede73c66fce0acc66e

                  SHA1

                  bb208cc812188fd76ddfb6b285ed5e9b461d708d

                  SHA256

                  99b9ea699a2e13dc0808b46dd218eee3b6673b002e6649167e0c5c9eafa8d22d

                  SHA512

                  bfd564fde6573fb189d2dce2429b2f4c3531b9ccc6ea5e1b9eeea2b693c6aded532eb1abd594e5aa63bf3a51529ba92b5c450c424373e057b5457d3758292f19

                  Download Submit

                • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
                  Filesize

                  238KB

                  MD5

                  816d316dd3655942bb366fd5865e3bdd

                  SHA1

                  a7838828456b38ee422470af127ab77389ba4aec

                  SHA256

                  472c8653babd2bc423ed47e752f3d50c251863e1bd0382e606065272c2a77018

                  SHA512

                  0b31ae06626546f5ed3c9bfb2a72cf3a07779815fd33ee9dc19e2917a3cb69ba11e454632a223a6296ea837ee34888eb51293a2584b750103c55350dbd57a584

                  Download Submit

                • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/DHxjWo.json
                  Filesize

                  483KB

                  MD5

                  8eef9936c65a15f444235238e6cc07ca

                  SHA1

                  c2bd026518fdb59efb5cf374a5eabb3029c12148

                  SHA256

                  ff4cf0596760c84aebb83ca5b0dad1e1ba9bc4dfde40550ef726521b773a31f7

                  SHA512

                  cefc5e056d91423d1b81423c08d56a031a724d5ac2b76b1b5c42836bf71777edaf2440f5045dd9146460a2f7b90848a3ef8c0b312f740d4cf57437ffec5f662b

                  Download Submit

                • /data/user/0/com.tobacco.gossip/app_DynamicOptDex/oat/DHxjWo.json.cur.prof
                  Filesize

                  325B

                  MD5

                  0190c2cfaba7feb83f992247cb02c564

                  SHA1

                  581c40da1054b3306093fd1ebff51b8ef84b4375

                  SHA256

                  36baa9f7e819effc9f68137085f04ebddd1612b70deeaaa4d90e45ac2dc91e16

                  SHA512

                  5f12c16320a2da46ece4affd47bee60d9e5bb7cbaa7e3057b2896f53ef0aebe3c9bdeed25f8465a8932dc9a10df41b02931ac92619b1c258e0b35d4f554bfcc2

                  Download Submit