Overview
overview
10Static
static
77142344ff1...b0.apk
android-9-x86
107142344ff1...b0.apk
android-10-x64
107142344ff1...b0.apk
android-11-x64
10aps-mraid.js
windows7-x64
1aps-mraid.js
windows10-2004-x64
1calendar1.html
windows7-x64
1calendar1.html
windows10-2004-x64
1circle1.html
windows7-x64
1circle1.html
windows10-2004-x64
1dtb-m.js
windows7-x64
1dtb-m.js
windows10-2004-x64
1fyb_iframe...l.html
windows7-x64
1fyb_iframe...l.html
windows10-2004-x64
1fyb_static...l.html
windows7-x64
1fyb_static...l.html
windows10-2004-x64
1libc763d2.so
ubuntu-18.04-amd64
libc763d2.so
debian-9-armhf
libc763d2.so
debian-9-mips
libc763d2.so
debian-9-mipsel
Analysis
-
max time kernel
2796348s -
max time network
135s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system -
submitted
06-11-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
aps-mraid.js
Resource
win7-20231025-en
Behavioral task
behavioral5
Sample
aps-mraid.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
calendar1.html
Resource
win7-20231020-en
Behavioral task
behavioral7
Sample
calendar1.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
circle1.html
Resource
win7-20231023-en
Behavioral task
behavioral9
Sample
circle1.html
Resource
win10v2004-20231025-en
Behavioral task
behavioral10
Sample
dtb-m.js
Resource
win7-20231020-en
Behavioral task
behavioral11
Sample
dtb-m.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
fyb_iframe_endcard_tmpl.html
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
fyb_iframe_endcard_tmpl.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
fyb_static_endcard_tmpl.html
Resource
win7-20231020-en
Behavioral task
behavioral15
Sample
fyb_static_endcard_tmpl.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
libc763d2.so
Resource
ubuntu1804-amd64-20231026-en
Behavioral task
behavioral17
Sample
libc763d2.so
Resource
debian9-armhf-20231026-en
Behavioral task
behavioral18
Sample
libc763d2.so
Resource
debian9-mipsbe-20231026-en
Behavioral task
behavioral19
Sample
libc763d2.so
Resource
debian9-mipsel-20231026-en
General
-
Target
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
-
Size
3.1MB
-
MD5
b1f4cb2c134e42e1c26f333097e17e56
-
SHA1
7fcfc163fe3f8bf5a54e38fe21ce559d6cafcd40
-
SHA256
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0
-
SHA512
c058f040f08f8ecd89498d0b86d24e6519cb7d46d594e50adcff54d08419eb025d49c3be1cdb4b5362800a574e67c33712046d927c06853f3f54f409aa503783
-
SSDEEP
49152:h7KMzjB309sF4vt5HW7zDC4SvQvM2rIg5ZNMErWfPzODZTq81hSjA3y:FKck6mV5mCgvM2rT5NrLlBjEAi
Malware Config
Extracted
alienbot
http://buuncanlidersvarmi11.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload 4 IoCs
Processes:
resource yara_rule /data/data/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus -
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
chef.isolate.taskdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId chef.isolate.task Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId chef.isolate.task -
Processes:
chef.isolate.taskpid process 4250 chef.isolate.task -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
chef.isolate.task/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/chef.isolate.task/app_DynamicOptDex/oat/x86/fTnEmT.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json 4250 chef.isolate.task /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json 4277 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/chef.isolate.task/app_DynamicOptDex/oat/x86/fTnEmT.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json 4250 chef.isolate.task -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
chef.isolate.taskdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS chef.isolate.task -
Removes a system notification. 1 IoCs
Processes:
chef.isolate.taskdescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag chef.isolate.task
Processes
-
chef.isolate.task1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4250 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/chef.isolate.task/app_DynamicOptDex/oat/x86/fTnEmT.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4277
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
718KB
MD5941798c87bc19acf81e9a30c5c9d342d
SHA19c729d4edf25fdebabe911858ac4d51551946284
SHA25689418d37f636411e97486c68de47965757b31da3a0b481979865c8efb5804fec
SHA512d803a09f708f2834f683a22d3077b41d6b7cc512ba41f777ecde4670d2bc63b4a357ff06699e530bf4c3fdbf0b6fd10a6c33e6c8e4b8015955724bfb3fb19cc0
-
Filesize
718KB
MD59848f326eb31b8eb6a6aff56e08eaa6f
SHA1475866a598c6c9d049f5ed2ffb3410d98edc7159
SHA256f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779
SHA512cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3
-
Filesize
463B
MD5dfd93517ab4c755b6bc910f4ceca3d1f
SHA18b8c34ddbdd176af7573a19bd9042abe017add70
SHA256ed7637431e8a52051f4fa839460a852dd04a7c945168242bdd839cd653bf955d
SHA512d981de26a4f0531f73b4bbecac71c002a99b3c24439438ff4ec5dde9a2b78e8a98e3ce81a44dec34f893f26153bf5449f350e07542e17c733383b441d26dcc23
-
Filesize
718KB
MD59848f326eb31b8eb6a6aff56e08eaa6f
SHA1475866a598c6c9d049f5ed2ffb3410d98edc7159
SHA256f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779
SHA512cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3
-
Filesize
718KB
MD580325e6176a8229b4277a4f9fd3167ef
SHA18a8603a983739865f6eee2d1e354b20a3d830aee
SHA256cece4981711ef42769076bb78c8f08b0f8e23555bfae65b7c6af42b174163e41
SHA512cce27a566dea2b768010540898a2dfaaedf475f49fcd26f5a752b69afddcdb71994701891ee03f7f95ddc1b6ed72aac01e9c7eecde223d4332a842b02895390a
-
Filesize
718KB
MD59848f326eb31b8eb6a6aff56e08eaa6f
SHA1475866a598c6c9d049f5ed2ffb3410d98edc7159
SHA256f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779
SHA512cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3