Overview

overview

10

Static

static

7

1f86e1061f...f1.apk

android-9-x86

10

1f86e1061f...f1.apk

android-10-x64

10

1f86e1061f...f1.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    4153609s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
  • submitted
    03-10-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f86e1061f612b9c691923c71d6eb0bdfb200b527e276265cffcead53bd72df1.apk

  • Size

    2.2MB

  • MD5

    1c19d02119a2eebc73f6dd06bda8eb3a

  • SHA1

    5102892b2b426e5a871bf17dad147831702b290f

  • SHA256

    1f86e1061f612b9c691923c71d6eb0bdfb200b527e276265cffcead53bd72df1

  • SHA512

    2159d45132a3ba88e44a720365201844ec79aa9e7be51f8bb15786a613398551e5bd489e0f03749129bac1a6a477dbdd90fc7fa6945ab9e8aa4e8c516c09bfbe

  • SSDEEP

    49152:cn9na/6Yj+Oayza7a/BM58PKFVI0J0801HBqfEYnocl1dIpkJORF5zDuxP:MJa/64+bWS1TvREYWMQzD4

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://eklimit.online

rc4.plain

Extracted

Family

alienbot

C2

http://eklimit.online

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.price.modify
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4172
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.price.modify/app_DynamicOptDex/ucTeNGk.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.price.modify/app_DynamicOptDex/oat/x86/ucTeNGk.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.price.modify/app_DynamicOptDex/oat/ucTeNGk.json.cur.prof
    Filesize

    481B

    MD5

    7bf095c50bd5845e665cb8eac23424f8

    SHA1

    27d818ff2d4478c47d9843b9c54b454779485b8d

    SHA256

    e6e9509e394c43f4609803eb2c0fb4408aaf8edbcf2dbe9b55ed59433e0b8cf0

    SHA512

    db69b55959ea056a6cf4b041ff52c0426a474eacbd9fbb08ff2685370dcb1288383d84fc46c36edce420086b31a096a407b1760165a464ae4f16d5f2afd6e07f

    Download Submit

  • /data/data/com.price.modify/app_DynamicOptDex/ucTeNGk.json
    Filesize

    238KB

    MD5

    a75699a4438a593e7c7e791fefc7e833

    SHA1

    ed4bd9ed9ee4778174791978282d0277403b7e3a

    SHA256

    7af6e01b3bd729faad1b1054ec96513848332cb1ead20efc786e95b63f45c534

    SHA512

    e07a35275adedde4078a9050a0aa584e0e877cf998e48050277e0f2711a5c05073b48dd0e460bf9acc2012db62b82d95914bcb451694b35e30c7b3cf341cf8fe

    Download Submit

  • /data/data/com.price.modify/app_DynamicOptDex/ucTeNGk.json
    Filesize

    238KB

    MD5

    e0fff57264a304c5561200b98c04aa32

    SHA1

    abe3e4d0b626d4d7397b88432b7c69ab0c71d95f

    SHA256

    d1fb4489b27d8b947418743db74ee7755412c36d38a1ce64883d540463508b05

    SHA512

    39ec0a1dc183ef90f35f583f13e1acf4d4ac238d072e9e4e055efa32e7db331d4fbef524663aee688b824611438ab4c94c0efb9f7ca5861a9e50d506157d0e5e

    Download Submit

  • /data/user/0/com.price.modify/app_DynamicOptDex/ucTeNGk.json
    Filesize

    483KB

    MD5

    241529abdb27087a4649de6dc82fa1fd

    SHA1

    21b992da12fd96a2567df0e444a75f8e73c12c5e

    SHA256

    a1eeeec92bde168a2f14271f047505df73dd01864b8545630760422966aaaa60

    SHA512

    f5399a011053e3ce5fdc0ae71b0e3aeffbe22bcc29236c1091e860559c9468ecdfaa3419177718f62d558046049fdae902f878c65c5571a9ebe0a8b887c65c49

    Download Submit

  • /data/user/0/com.price.modify/app_DynamicOptDex/ucTeNGk.json
    Filesize

    483KB

    MD5

    b62433d8f6929582425b73af4a70c22c

    SHA1

    e550a51324db7c0a1ff09ed03d75ed180188a05c

    SHA256

    188b8f0aefc0e07eb49cde1cca3a7a46689cb68740fab34d8d1bfd78330c676a

    SHA512

    9c0336c0ba9e2b49a3a57fc0b72d95b91afe42dee7ab5146d1e4b6412174963453aa29dfb37ea54ef48c0f041eef76879cb60e2cea6e0624450f4fff6846d1a7

    Download Submit