Analysis
-
max time kernel
2343438s -
max time network
161s -
platform
android_x64 -
resource
android-x64-20230831-en -
resource tags
-
submitted
12-09-2023 23:13
General
-
Target
0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363.apk
-
Size
2.1MB
-
MD5
e40024f930c3f19b89b0f0639e3e048c
-
SHA1
44255903ab77c97c9de06e7a52921593cdb89483
-
SHA256
0422433a6cea4da9fa32db2410144f406f01eec5ff5915b2b8c192ec3639b363
-
SHA512
326d8facbbd82b6eeac70a04ab5cbc3426a5e5242d4edf3dd49109e75742838cd0edb7e4018ca82321cc72f086fcff33d106805628d5f370df97fea5b70b0fcc
-
SSDEEP
49152:L6pmUQoDTrOiCFPA2gL0J0801VBUf2cRqcl1dIpkJ8Rp5/0xNew:1ULrOiCFAM2cyMy/0PR
Malware Config
Extracted
alienbot
http://limit-tanimlama.net
Extracted
alienbot
http://limit-tanimlama.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 5 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
com.supply.oil1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD510a6e436b0bee31a9f2ed74b4d6a50b7
SHA10360f72ad2b82c42da703114162d8b4566613481
SHA256087fd075a58880efd16d03724740416bf331634a3bffce2af075172f709837fe
SHA5126b62579a92291baf3844eb4747eb2a05024f4283bb35906aa415b265b3f008a87a159c89890b1f7ba4789d87125c1e92c6fde75408209a3d1872f9b1b8c014e5
-
Filesize
238KB
MD5784200c45e8d5ec0e504d4e09cb8fc87
SHA1d4c2d36a6e328a28108cf4cdd3bae967f65369b3
SHA25605514060c89e27fae692115142f190dc10e39060d21a0e9523da6cf684d5a84f
SHA512476cbaa17406636f20cf23062c69902d57f0199a053e556cb15ad6f0c3b5722ab9b5ddf81b38b9cc2754c162b8050cd20a6250793af60507600c23dc35050a0c
-
Filesize
390B
MD55f26b8dc176ccffe570a7a3a75377e16
SHA1092a888c412333eab5f462777099d76311a899df
SHA256e1228512077965c3477d4bb890262f3cb8d99a60de1544cec7f1430cf737899b
SHA5120d491f43a56e059c41ad9b4560bc38a7835f647707244822bf99ce10b7c8fdee336ae1c0d73d08c442a048627f8b0161b1cdfe15ee8cc1093a4f0ea19698b543
-
Filesize
483KB
MD5013a804a457ce0c5e63f4003bd15c301
SHA11dd06b6d8465833e012c9cc070d63844b176ef6a
SHA2565ee7fd2974b8ba94491cd02575da34d60affe0228ae5a30ad478d820e0226663
SHA512a121e0a32bf0eebf9239b8e52d6efb1df4655c0c11314bf08620897431c1d297019caf4122acb73ced329552460770afcc4464d13199b928290b6180a3963fcb