Analysis
-
max time kernel
776985s -
max time network
163s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
-
submitted
14-10-2023 00:51
General
-
Target
1b51293002041bfee9c8daba4eda7fe5b4678ef1b9ee693cced004400bf01d64.apk
-
Size
2.1MB
-
MD5
e66ac604e5898c0e639db52ca8258b17
-
SHA1
d03e3c798a5cc7b8f3f3b521dae119a932d4fb2e
-
SHA256
1b51293002041bfee9c8daba4eda7fe5b4678ef1b9ee693cced004400bf01d64
-
SHA512
18de30f7aec32792165b90cad8792ea2946e45616e889a507288a55f1a6dbd9c680a6ca3ef776158685f683f588f3dbd0382c7ab0a1193a502af42eee7bc9b96
-
SSDEEP
49152:DCU2f145StuFvk2bPEGX69oMfYi0Z0J0801gLzr1k6Dcl1dIpkJaavh/7c5L/Rng:af19EFswMGAff1kyM4Vlw
Malware Config
Extracted
alienbot
http://23.88.40.50
Extracted
alienbot
http://23.88.40.50
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.cattle.way1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5f3985de7f85cf76cfa98e6c1e0477c61
SHA1fed6b8d0fd062b72b031fcb2c65dd0eeda29326c
SHA25677b822ba471e584f6a624e39aa7e30aee06996b75920a5eac9198244d7edfb87
SHA51294a8b72324408f8da621db348bf2aed7c96927da838f611d48b84431334507ca592e260fa48e6adcf63eafde427201bbee079678d998bb8d5d1bc4b8c59d0ec8
-
Filesize
238KB
MD5b5c02c909a7078df281f55ca9e60af8a
SHA103068e95674919cdbc49a289b2b33b668dff6a40
SHA256a7828afdec786b19764540a2437575fcac02107139314c4140574b45a9dd159a
SHA512a6d3f5cbf93fe3854be6b9aacc97dde9d4c68954a32ce2323fff648871e027a77ebdaa492c2ded2ceb0e9103ab06d5e95d6345e7ed4feabdc6e405b3f7a139e9
-
Filesize
483KB
MD5cd5443f4f22b8a71f1d6aa4c9dc7b95d
SHA19044803662bf5b81c8181ed5cd92ec45974875db
SHA2565027e406bb115f8b0312928d979392edf7e73bf194ff3712c9bfe2661750452f
SHA512c122c4774f603bff013425b36575f4cd7257b48db9fa86b99477ffc25c71d1d55c7e12fbe86cefeb98bb35bb869abb060b0d02490c987e587c6415f259be926d
-
Filesize
323B
MD5b8047385addbb9597d0b0b2cfa2beb41
SHA17ea408eb3ebdb629531fdfd9cd307758fc80588d
SHA256c88e704bd411fcf3fedbcdd0633e2710682a0674ff37714f139706ffac6fb6fe
SHA512cccc3a29b90412d1d6e11f9dfc39aa28ecd6305d553109e70b3ab26db24f76d48fe477ec5b66c99d8c039bfeb87b6c535fa67c3c646339006f2c7af6b71c4a42