Overview
overview
10Static
static
7636f6e438f...53.apk
android-9-x86
10636f6e438f...53.apk
android-10-x64
10636f6e438f...53.apk
android-11-x64
101bf84a89-2...c0e.js
windows7-x64
11bf84a89-2...c0e.js
windows10-2004-x64
1ad.html
windows7-x64
1ad.html
windows10-2004-x64
1aps-mraid.js
windows7-x64
1aps-mraid.js
windows10-2004-x64
1assign_lab...l.html
windows7-x64
1assign_lab...l.html
windows10-2004-x64
1blood_gluc...l.html
windows7-x64
1blood_gluc...l.html
windows10-2004-x64
1blood_gluc...l.html
windows7-x64
1blood_gluc...l.html
windows10-2004-x64
1blood_pres...l.html
windows7-x64
1blood_pres...l.html
windows10-2004-x64
1consentform.html
windows7-x64
1consentform.html
windows10-2004-x64
1diabetes_r...l.html
windows7-x64
1diabetes_r...l.html
windows10-2004-x64
1dpr_report.html
windows7-x64
1dpr_report.html
windows10-2004-x64
1dtb-m.js
windows7-x64
1dtb-m.js
windows10-2004-x64
1edit_insul...l.html
windows7-x64
1edit_insul...l.html
windows10-2004-x64
1edit_label...l.html
windows7-x64
1edit_label...l.html
windows10-2004-x64
1edit_medic...l.html
windows7-x64
1edit_medic...l.html
windows10-2004-x64
1edit_track...l.html
windows7-x64
1Analysis
-
max time kernel
376918s -
max time network
165s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system -
submitted
09-10-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
1bf84a89-28f7574e191c74305c0e.js
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
1bf84a89-28f7574e191c74305c0e.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
ad.html
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
ad.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
aps-mraid.js
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
aps-mraid.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
assign_labels_local.html
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
assign_labels_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
blood_glucose_entry_local.html
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
blood_glucose_entry_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
blood_glucose_local.html
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
blood_glucose_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
blood_pressure_entry_local.html
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
blood_pressure_entry_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
consentform.html
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
consentform.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral20
Sample
diabetes_reports_local.html
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
diabetes_reports_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
dpr_report.html
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
dpr_report.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral24
Sample
dtb-m.js
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
dtb-m.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral26
Sample
edit_insulin_local.html
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
edit_insulin_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
edit_labels_local.html
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
edit_labels_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
edit_medication_local.html
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
edit_medication_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
edit_tracker_local.html
Resource
win7-20230831-en
General
-
Target
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
-
Size
2.4MB
-
MD5
eed58d8862fd0b8ff3c297ea02a03f70
-
SHA1
5cee6a82eb3e4b44afddac228d8ea99a707dde95
-
SHA256
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53
-
SHA512
e9ba99cf3c72ce598d390a288b9dfe0c8a9ad75cd88d5a18fe3bda52ed1166ea5e6c611db958420e6405021106fe016d619a6ce6bf318d474f5104e4bb0fb576
-
SSDEEP
49152:IC17Qkq1/GgY1mevw/I6lz2XNEKvrl6GGViojEe8ZqSbc+tk3X0ghbbTWQrgSoWI:N1HCqIwXNEKxGo0EFqSgeWkw/WQrgs7U
Malware Config
Extracted
alienbot
http://girisapi6117.pw
Extracted
alienbot
http://girisapi6117.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload 1 IoCs
resource yara_rule behavioral3/memory/4649-0.dex family_cerberus -
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.harvest.deliver Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.harvest.deliver -
pid Process 4649 com.harvest.deliver 4649 com.harvest.deliver 4649 com.harvest.deliver 4649 com.harvest.deliver 4649 com.harvest.deliver -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.harvest.deliver -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.harvest.deliver/app_DynamicOptDex/glp.json 4649 com.harvest.deliver -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.harvest.deliver
Processes
-
com.harvest.deliver1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4649 -
getprop ro.miui.ui.version.name2⤵PID:4826
-
-
getprop ro.miui.ui.version.name2⤵PID:4925
-
-
getprop ro.miui.ui.version.name2⤵PID:5045
-
-
getprop ro.miui.ui.version.name2⤵PID:5081
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD517c45cefe32eed801a722cf24d43f561
SHA1fd5c288d4fb5dd82d8c39d6d0560eda526b737ae
SHA25646903e7aad0b7467df2d04b0752446d87151027e68f9c744598574bc9484990c
SHA5125c4608900cffc7803ac6ee21c976783e887c0ca39d46c668dad028c9e148b4278dd1241189dc3675044e6fd988c46f2a41e8a45f1493f8773559b93f9fb1d930
-
Filesize
238KB
MD509e1bf9deaa8dd4ac36de22890a1073e
SHA15ac2747b17c321b37cec7d3a68324c741b2bbf86
SHA256269c6ff16107c4182315ad4e1fe37ff14fd7d4c7369ad4d3892b155e24b53ff2
SHA5125cc089ef5ece2be15edcbf42cfaeb640969438e0639f848485e0420e53bb0d93b261ab09f4504b824b1c294174ba4d81c8e114a0c1d479f567f8d6acfe7dcc39
-
Filesize
483KB
MD5a6f2246722f016eef5a1989024ef6af6
SHA1fd6bfe5782155df1c1bb12120b8fcfecfc2f9be6
SHA2565195e8a6e11a076e0cde874ff2df9055f7e5e14fec679800d6b3601dcd9cb7e4
SHA512b71857e991363972074a4894e3c384b9a5c9c81607e808c822dd0669032d0d7e0cf3f9120fb1d921fc5ab1bfe286c153c00effdd82a1fa564970aa0b9c0a17aa
-
Filesize
316B
MD5ae3e42631f08e495f4fca32f738ba5ac
SHA13a27bcd65daddea53db818cc85bee3a170456f08
SHA256b7927885f7a68562a0f127a5a84306007967997e55f8fad515ab5321d614d816
SHA512e8f8cff01da8bb8645e452d9da1d8f77ed9bf87f28c926de0681390379ff9a048abcec238d360c30cd63b95ee8b20866e145afc45395e6c9517a423e5f32f191