Analysis
-
max time kernel
2491367s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
14-09-2023 16:18
General
-
Target
1b51293002041bfee9c8daba4eda7fe5b4678ef1b9ee693cced004400bf01d64.apk
-
Size
2.1MB
-
MD5
e66ac604e5898c0e639db52ca8258b17
-
SHA1
d03e3c798a5cc7b8f3f3b521dae119a932d4fb2e
-
SHA256
1b51293002041bfee9c8daba4eda7fe5b4678ef1b9ee693cced004400bf01d64
-
SHA512
18de30f7aec32792165b90cad8792ea2946e45616e889a507288a55f1a6dbd9c680a6ca3ef776158685f683f588f3dbd0382c7ab0a1193a502af42eee7bc9b96
-
SSDEEP
49152:DCU2f145StuFvk2bPEGX69oMfYi0Z0J0801gLzr1k6Dcl1dIpkJaavh/7c5L/Rng:af19EFswMGAff1kyM4Vlw
Malware Config
Extracted
alienbot
http://23.88.40.50
Extracted
alienbot
http://23.88.40.50
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.cattle.way1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5f3985de7f85cf76cfa98e6c1e0477c61
SHA1fed6b8d0fd062b72b031fcb2c65dd0eeda29326c
SHA25677b822ba471e584f6a624e39aa7e30aee06996b75920a5eac9198244d7edfb87
SHA51294a8b72324408f8da621db348bf2aed7c96927da838f611d48b84431334507ca592e260fa48e6adcf63eafde427201bbee079678d998bb8d5d1bc4b8c59d0ec8
-
Filesize
238KB
MD5b5c02c909a7078df281f55ca9e60af8a
SHA103068e95674919cdbc49a289b2b33b668dff6a40
SHA256a7828afdec786b19764540a2437575fcac02107139314c4140574b45a9dd159a
SHA512a6d3f5cbf93fe3854be6b9aacc97dde9d4c68954a32ce2323fff648871e027a77ebdaa492c2ded2ceb0e9103ab06d5e95d6345e7ed4feabdc6e405b3f7a139e9
-
Filesize
413B
MD595a615b73bab0bc234b56a403e6ba535
SHA12113214aea595f8167cf94daaa7d78d761deb7b5
SHA256c42a5fa3519f28ce58b58d58b0d5ac8ce4d8f2802432090288c86b83f6ba9c3c
SHA51245de1462c19f3c8cb35b663183c6b95e015c8f9547d7e56de07dbb41eaf559844bfb0cdd580d5664a0288d1e087fbdcc052544734977d0f05e4b0267fce3333c
-
Filesize
483KB
MD5cd5443f4f22b8a71f1d6aa4c9dc7b95d
SHA19044803662bf5b81c8181ed5cd92ec45974875db
SHA2565027e406bb115f8b0312928d979392edf7e73bf194ff3712c9bfe2661750452f
SHA512c122c4774f603bff013425b36575f4cd7257b48db9fa86b99477ffc25c71d1d55c7e12fbe86cefeb98bb35bb869abb060b0d02490c987e587c6415f259be926d