Overview

overview

10

Static

static

7

d358000cd1...15.apk

android-9-x86

10

d358000cd1...15.apk

android-10-x64

10

d358000cd1...15.apk

android-11-x64

10

HM_JsBridge.js

windows7-x64

1

HM_JsBridge.js

windows10-2004-x64

1

consentform.html

windows7-x64

1

consentform.html

windows10-2004-x64

1

Analysis

  • max time kernel
    4239852s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
  • submitted
    04-10-2023 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d358000cd10d3182c1f5a11d68a6a35952adb70ee4119deebe8a9861f61f3515.apk

  • Size

    2.3MB

  • MD5

    8a2b5d2b6879c1e4770018eeae8e6570

  • SHA1

    be7c2a1d9d05d9cc577eede1c4a0b08f9566d7bb

  • SHA256

    d358000cd10d3182c1f5a11d68a6a35952adb70ee4119deebe8a9861f61f3515

  • SHA512

    2e2ac2d150ef4d73ec41ed1c301846d60614f56a7ab0088e30ff4df2a966c6b5b03f91307189b3c168f9d4bff9d4dbfe4c98bd17457c8a215432ec4f3b197d9f

  • SSDEEP

    49152:8UyvbfQ0fv9BFtZpi8e0N0H8XwF0J0801UvLJyNrgI1rN9Umrcl1dIpkJsRt5/Z:89vbfQ0fv97tLi78OSArN9UOM2/Z

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://eklimitonay.online

rc4.plain

Extracted

Family

alienbot

C2

http://eklimitonay.online

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.bracket.response
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4174
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bracket.response/app_DynamicOptDex/poOgS.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.bracket.response/app_DynamicOptDex/oat/x86/poOgS.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4199

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.bracket.response/app_DynamicOptDex/oat/poOgS.json.cur.prof
    Filesize

    468B

    MD5

    e412da86696504a043174151f29ab837

    SHA1

    3cfeb714eb0a3194db8d6897fc2c2791dfdba11e

    SHA256

    3dee9886ed3b23090c0581c581f5c1e7ee3f392b07e1dfc5c6873b4176219e1b

    SHA512

    d967258b39bb2a4edf9007805e94d6d27be45b3855a126a8327374ff62922ca91018d44f86aa49358041157799fd89280ce8f9ebc46930384f86c4669e205e2f

    Download Submit

  • /data/data/com.bracket.response/app_DynamicOptDex/poOgS.json
    Filesize

    238KB

    MD5

    eb12dc860803fa235a67514476abad82

    SHA1

    06816b1c6187a7d140be9a0c13a6ffaa66f9dc70

    SHA256

    b3f6b4cc6cd8bff456f4aa2ef985a46d20f892e90ad78214d73417a8710be91e

    SHA512

    0c206e3eede4351cb67034e9dcf24fae3bb07fc091486a222a142eb0b28932e143b96db93f141a1a4b1568b0599ddc4c4bda4f992ed1c621ec410e5fd8a1bb46

    Download Submit

  • /data/data/com.bracket.response/app_DynamicOptDex/poOgS.json
    Filesize

    238KB

    MD5

    ea34525b6118054f1c247d9b9f12a88e

    SHA1

    320867b799af423780a346ce10032892d008369b

    SHA256

    46b133f9cd50cd7145b350f39b519a5956a63ef7b845a8e1c9dd0ae42791993c

    SHA512

    f304308b9df778f80b8e3c8901d74160af7bce928a980a41bc651fb9cddbb75e1c03e8330797691870f7901fd9dd4188410d6722a1709e5b884f095e6e68d03e

    Download Submit

  • /data/user/0/com.bracket.response/app_DynamicOptDex/poOgS.json
    Filesize

    483KB

    MD5

    41e439e3c62b9885f1dbd5934dde2949

    SHA1

    73ded2dacfe908dc8ed08a3535d0111d712501a3

    SHA256

    5aae4163bcb5869a98f0fd358726b42076b58b30db4ee0e24951952a2ad8a6a0

    SHA512

    e5b47ba9910f9ab6ded461dfc33dabe65d7ee2b6cdfced599c6ca126a4786391492ef514435e567e522932fac27bb425f1a54b7ca9ba8e2933e7d6d1e490a9a2

    Download Submit

  • /data/user/0/com.bracket.response/app_DynamicOptDex/poOgS.json
    Filesize

    483KB

    MD5

    3eb1657245e2ca6c42bbeafacf31f02a

    SHA1

    b6b5ab7a1d86a3aca95133cda391d8e7cae42fae

    SHA256

    2a5102bb793252bcaa0bd5c08aba8410b48bca16a383975130bc5dd3f8a64af2

    SHA512

    316106d36bb571b8ecb4666c460e38645c273d2ef33643544c3b800610443ab4a256474486711a0f1285d28ec78ca448d7302adb8ee32d8923ebeec038a67767

    Download Submit