Analysis
-
max time kernel
2343434s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
12-09-2023 23:13
General
-
Target
0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363.apk
-
Size
2.1MB
-
MD5
e40024f930c3f19b89b0f0639e3e048c
-
SHA1
44255903ab77c97c9de06e7a52921593cdb89483
-
SHA256
0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363
-
SHA512
326d8facbbd82b6eeac70a04ab5cbc3426a5e5242d4edf3dd49109e75742838cd0edb7e4018ca82321cc72f086fcff33d106805628d5f370df97fea5b70b0fcc
-
SSDEEP
49152:L6pmUQoDTrOiCFPA2gL0J0801VBUf2cRqcl1dIpkJ8Rp5/0xNew:1ULrOiCFAM2cyMy/0PR
Malware Config
Extracted
alienbot
http://limit-tanimlama.net
Extracted
alienbot
http://limit-tanimlama.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.supply.oil1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD510a6e436b0bee31a9f2ed74b4d6a50b7
SHA10360f72ad2b82c42da703114162d8b4566613481
SHA256087fd075a58880efd16d03724740416bf331634a3bffce2af075172f709837fe
SHA5126b62579a92291baf3844eb4747eb2a05024f4283bb35906aa415b265b3f008a87a159c89890b1f7ba4789d87125c1e92c6fde75408209a3d1872f9b1b8c014e5
-
Filesize
238KB
MD5784200c45e8d5ec0e504d4e09cb8fc87
SHA1d4c2d36a6e328a28108cf4cdd3bae967f65369b3
SHA25605514060c89e27fae692115142f190dc10e39060d21a0e9523da6cf684d5a84f
SHA512476cbaa17406636f20cf23062c69902d57f0199a053e556cb15ad6f0c3b5722ab9b5ddf81b38b9cc2754c162b8050cd20a6250793af60507600c23dc35050a0c
-
Filesize
415B
MD5fcdc465ed6f220177dfd7cca1382fe68
SHA1281f7a83eaffba2f406116bea5f661077c5a557f
SHA256307420403c302f1a2f70038a2e8474f110826376baefb8989fd72fbf2628fb6c
SHA51234953fe6f5a9fdd48532802b8421f96630d224ed1a6881bf08451a714e7dc055853fb2e7667d6474df8c745dc22015db2acd63c16f75b88048dddc8111b0a8cc
-
Filesize
483KB
MD5013a804a457ce0c5e63f4003bd15c301
SHA11dd06b6d8465833e012c9cc070d63844b176ef6a
SHA2565ee7fd2974b8ba94491cd02575da34d60affe0228ae5a30ad478d820e0226663
SHA512a121e0a32bf0eebf9239b8e52d6efb1df4655c0c11314bf08620897431c1d297019caf4122acb73ced329552460770afcc4464d13199b928290b6180a3963fcb