Analysis
-
max time kernel
3635595s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
27-09-2023 22:02
General
-
Target
5749211e8e6f11210b0d09dfdcc3f515ed591f222f2ee69c1e1eaed2ad304474.apk
-
Size
2.1MB
-
MD5
452ac293c79df1615440b0bc35118a29
-
SHA1
e587c096d2da807c24552db937f7982e5ce54234
-
SHA256
5749211e8e6f11210b0d09dfdcc3f515ed591f222f2ee69c1e1eaed2ad304474
-
SHA512
96879a065cd8d0744c98fa87500eecc11eb9c4eaa7a4c4993790cb7a598af7f646784006edb3b8ea30b4fb09618e5d5c84271de9cf3d61207be3b208f29e2f2f
-
SSDEEP
49152:yZp061pD55yo+TkJKxG0J0801af53v2s85cl1dIpkJRRb5xo:yZp5DZk152suMJxo
Malware Config
Extracted
alienbot
http://0d24c9424c2347f9b.pw
Extracted
alienbot
http://0d24c9424c2347f9b.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.slush.very1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD573d4f1af21998352c6fc24f072ceb597
SHA12d98935662d4ae2e19cab9967db43ee6a7ad2015
SHA25648da8bd42239bbd9cc9d55f51c6929c88cd40077f3642995a3af8117162061e6
SHA5122ef4b3ab7b4bd773f67f8c439c91a23d4094e6337bc6acf03c69d1ccc680c425bdeac52050775b19927be7013e930d2b86fb68780bdc7a85fb379fa25e2079f8
-
Filesize
238KB
MD5d4bd8907fda9d4d4c7775eb44a701ab2
SHA16146eaedb8c21def25045505b67e7fa0301c3b2d
SHA256d325106e4ddefe331f8ea6ba81437633d64e0ef2b18ca0155e91bfcfc0762904
SHA512ad16694033b0bd6cc9f7b5674918e84fbc928da2a36b61e740df51bd1d1b4356038c4328e19566238f6f4beeb95857c6a5c3aa137ad7c144a187c87219ae9944
-
Filesize
415B
MD5413be90c0b0aa0a549905a6d0a251e13
SHA14eb70718104b4947b053401c6f8b140b914b0a24
SHA256d01c08d34d31540af73f671d1c168c758c874774d24880804e425a56ac81d2fa
SHA5120daac81332baba80b19242a22560ce874a28df22dbaefc44d7514a24338a91f03dc0ee4441f5c859d818273a9d7e9f9b8ee4ca46588f9639e9437cc50410e658
-
Filesize
483KB
MD5dc859becbc717473e717613c86fb0bbb
SHA1e547efa49d03e0195b26cb23d322a4dcb4578cb1
SHA2565c7e44e300c8beab02d5100e181aa7f807c4e1f8698c02d07a1539db279b9288
SHA5121cb1bc06c4f776cd51a58fe8587c79d948e7fb4d324256eebc5158fc4a573030e85f17a63cbfd5e6078444ac7559b554751dc8c2c542b5f58a0feb58ab02bdb5