Analysis
-
max time kernel
377821s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
09-10-2023 22:08
General
-
Target
43f7de64b8026fa16a4e0b74a9a3d1c879db3098c9780ac202fc2113a5577c48.apk
-
Size
4.3MB
-
MD5
5821d41b75a741cbf411f02eba9e85df
-
SHA1
6cfc9e0fe629d884e23a40247dfd040f47c511eb
-
SHA256
43f7de64b8026fa16a4e0b74a9a3d1c879db3098c9780ac202fc2113a5577c48
-
SHA512
ba1edb32d7d65bf6ddb7b6da2553e5898167c5bd4671c1e5da0eab7cdf873a1e018450a4a62a3dbc35aa70e9236c63a36b6b8b103474552b89ff726355acfe4f
-
SSDEEP
98304:P2HJ6clSJ5WC2SX/Kpym5SBzvq/h/P9/GKJRyHjVmMkfbh1mMXyZYv+Afez8E:+pFZ1cm5SuTexZk91DgYWp
Malware Config
Extracted
alienbot
http://wf4sctx9cksg94528o7o.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 7 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
fr.associated.string1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fr.associated.string/app_DynamicOptDex/aZiccBex.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fr.associated.string/app_DynamicOptDex/oat/x86/aZiccBex.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD571ddacd8a2cb40df18134c90a1bb4be2
SHA1293b301ee8eb182182214f1a23c9d50c9dcec727
SHA2567b9a551a5ed085cd9c0d9423e763ff7a51d01fee25b078be7c6e85aefd6c6836
SHA512f12ea753b2066e1d195969efb56cb226476ce7d86d28cf452ec6b087fc6f1786fff4c20282c1a242063dbf7bb52de74d60cafa8d6f9edccfe89d6bb623492aaf
-
Filesize
704KB
MD5c79398dd96dad9fa31b8da95334ef0b9
SHA198b969ccd2423bd76402fc96baf24704a8a35406
SHA25683c8b8636a889d87c90671c1172dbdef67030bdbd62829a8db1c6372001e72b3
SHA512fe628d0079582bc7ae6f536af76da3d1038fdd715a62a58e254e801b91f7928135b14701bb5960bfe582ea7e88a7f1ec77319f55ed46c0bbc4f2936eaa91d574
-
Filesize
1KB
MD52007010406bd0e5663227c624cc0282f
SHA1efa48ec5234120ca015ead18602e73bd7341e741
SHA2561ff21b128c409fd24dc403fe86c7a1039e2cc053a96876e2831c8373d819c49f
SHA512f17af8553982df8e91463575ad2aebc7599cd17066c33dac790f6c351ff15f2fdae1f22dcc5e996e22339a54cd467a1d926a0dfae855f0edf8e299fd281fc3d6
-
Filesize
916KB
MD59d7303454701903d24bf29a1e8a24408
SHA14df0979ebc2064ceaab58a10ebd93a193a8c3b30
SHA256ae24eef251004b4c48e4c7a7d2d9744120f6acc2f274bf7d605bd80278b4c880
SHA51264ddf3f379bb36487d501b697822f5015285a5e724816a6fdcbfe83fe25d21d22bc621d9c7b9a597a2828d630f4635b045adff86e59600a17a481aa5b81ed019
-
Filesize
916KB
MD50930ec69d81f4b96649d36d7b6f24b90
SHA1349be2cb09fd8974250fe3aa03b54a43ab1da09c
SHA2565d30844dfc43fa7dba25603cde401697fd5c3f857e4f59fded3c41db719ad3de
SHA5120771ec5c54d5c68be8301d5ddbb7ad5904e24f32fc8d1ce6a085410e9985a71653a0e69a3f892868369dbab3c85ebdd5345bb25244f29665f021551f694b3045