Overview

overview

10

Static

static

7

1f86e1061f...f1.apk

android-9-x86

10

1f86e1061f...f1.apk

android-10-x64

10

1f86e1061f...f1.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    4153675s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    03-10-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f86e1061f612b9c691923c71d6eb0bdfb200b527e276265cffcead53bd72df1.apk

  • Size

    2.2MB

  • MD5

    1c19d02119a2eebc73f6dd06bda8eb3a

  • SHA1

    5102892b2b426e5a871bf17dad147831702b290f

  • SHA256

    1f86e1061f612b9c691923c71d6eb0bdfb200b527e276265cffcead53bd72df1

  • SHA512

    2159d45132a3ba88e44a720365201844ec79aa9e7be51f8bb15786a613398551e5bd489e0f03749129bac1a6a477dbdd90fc7fa6945ab9e8aa4e8c516c09bfbe

  • SSDEEP

    49152:cn9na/6Yj+Oayza7a/BM58PKFVI0J0801HBqfEYnocl1dIpkJORF5zDuxP:MJa/64+bWS1TvREYWMQzD4

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://eklimit.online

rc4.plain

Extracted

Family

alienbot

C2

http://eklimit.online

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.price.modify
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4503
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4775
      • getprop ro.miui.ui.version.name
        2⤵
          PID:4862
        • getprop ro.miui.ui.version.name
          2⤵
            PID:5011
          • getprop ro.miui.ui.version.name
            2⤵
              PID:5053
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5083
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5117
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5160

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.price.modify/app_DynamicOptDex/oat/ucTeNGk.json.cur.prof
                  Filesize

                  319B

                  MD5

                  62fcd292484dfa2bdccc604f589b3317

                  SHA1

                  1b2b07b2dd75a4583ad297c558a491eefbc31f8e

                  SHA256

                  872f4448efba2973858c817ab395420126b406d812aafbe87307f3eefdfce3a8

                  SHA512

                  9f6a057618ece2e52e9437d1554a4cf899ca44e2e2fca7f452d082a4671cfddd25c6b6f509e9abbfb24528d4e961d766a5865a02c0dbba7d996be5773d8ddfb3

                  Download Submit

                • /data/user/0/com.price.modify/app_DynamicOptDex/ucTeNGk.json
                  Filesize

                  238KB

                  MD5

                  a75699a4438a593e7c7e791fefc7e833

                  SHA1

                  ed4bd9ed9ee4778174791978282d0277403b7e3a

                  SHA256

                  7af6e01b3bd729faad1b1054ec96513848332cb1ead20efc786e95b63f45c534

                  SHA512

                  e07a35275adedde4078a9050a0aa584e0e877cf998e48050277e0f2711a5c05073b48dd0e460bf9acc2012db62b82d95914bcb451694b35e30c7b3cf341cf8fe

                  Download Submit

                • /data/user/0/com.price.modify/app_DynamicOptDex/ucTeNGk.json
                  Filesize

                  238KB

                  MD5

                  e0fff57264a304c5561200b98c04aa32

                  SHA1

                  abe3e4d0b626d4d7397b88432b7c69ab0c71d95f

                  SHA256

                  d1fb4489b27d8b947418743db74ee7755412c36d38a1ce64883d540463508b05

                  SHA512

                  39ec0a1dc183ef90f35f583f13e1acf4d4ac238d072e9e4e055efa32e7db331d4fbef524663aee688b824611438ab4c94c0efb9f7ca5861a9e50d506157d0e5e

                  Download Submit

                • /data/user/0/com.price.modify/app_DynamicOptDex/ucTeNGk.json
                  Filesize

                  483KB

                  MD5

                  b62433d8f6929582425b73af4a70c22c

                  SHA1

                  e550a51324db7c0a1ff09ed03d75ed180188a05c

                  SHA256

                  188b8f0aefc0e07eb49cde1cca3a7a46689cb68740fab34d8d1bfd78330c676a

                  SHA512

                  9c0336c0ba9e2b49a3a57fc0b72d95b91afe42dee7ab5146d1e4b6412174963453aa29dfb37ea54ef48c0f041eef76879cb60e2cea6e0624450f4fff6846d1a7

                  Download Submit