Analysis

  • max time kernel
    2796348s
  • max time network
    135s
  • platform
    android_x86
  • resource
    android-x86-arm-20231023-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
  • submitted
    06-11-2023 22:00

General

  • Target

    7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk

  • Size

    3.1MB

  • MD5

    b1f4cb2c134e42e1c26f333097e17e56

  • SHA1

    7fcfc163fe3f8bf5a54e38fe21ce559d6cafcd40

  • SHA256

    7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0

  • SHA512

    c058f040f08f8ecd89498d0b86d24e6519cb7d46d594e50adcff54d08419eb025d49c3be1cdb4b5362800a574e67c33712046d927c06853f3f54f409aa503783

  • SSDEEP

    49152:h7KMzjB309sF4vt5HW7zDC4SvQvM2rIg5ZNMErWfPzODZTq81hSjA3y:FKck6mV5mCgvM2rT5NrLlBjEAi

Malware Config

Extracted

Family

alienbot

C2

http://buuncanlidersvarmi11.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Cerberus payload 4 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs

Processes

  • chef.isolate.task
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4250
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/chef.isolate.task/app_DynamicOptDex/oat/x86/fTnEmT.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4277

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/chef.isolate.task/app_DynamicOptDex/fTnEmT.json

    Filesize

    718KB

    MD5

    941798c87bc19acf81e9a30c5c9d342d

    SHA1

    9c729d4edf25fdebabe911858ac4d51551946284

    SHA256

    89418d37f636411e97486c68de47965757b31da3a0b481979865c8efb5804fec

    SHA512

    d803a09f708f2834f683a22d3077b41d6b7cc512ba41f777ecde4670d2bc63b4a357ff06699e530bf4c3fdbf0b6fd10a6c33e6c8e4b8015955724bfb3fb19cc0

  • /data/data/chef.isolate.task/app_DynamicOptDex/fTnEmT.json

    Filesize

    718KB

    MD5

    9848f326eb31b8eb6a6aff56e08eaa6f

    SHA1

    475866a598c6c9d049f5ed2ffb3410d98edc7159

    SHA256

    f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779

    SHA512

    cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3

  • /data/data/chef.isolate.task/app_DynamicOptDex/oat/fTnEmT.json.cur.prof

    Filesize

    463B

    MD5

    dfd93517ab4c755b6bc910f4ceca3d1f

    SHA1

    8b8c34ddbdd176af7573a19bd9042abe017add70

    SHA256

    ed7637431e8a52051f4fa839460a852dd04a7c945168242bdd839cd653bf955d

    SHA512

    d981de26a4f0531f73b4bbecac71c002a99b3c24439438ff4ec5dde9a2b78e8a98e3ce81a44dec34f893f26153bf5449f350e07542e17c733383b441d26dcc23

  • /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json

    Filesize

    718KB

    MD5

    9848f326eb31b8eb6a6aff56e08eaa6f

    SHA1

    475866a598c6c9d049f5ed2ffb3410d98edc7159

    SHA256

    f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779

    SHA512

    cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3

  • /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json

    Filesize

    718KB

    MD5

    80325e6176a8229b4277a4f9fd3167ef

    SHA1

    8a8603a983739865f6eee2d1e354b20a3d830aee

    SHA256

    cece4981711ef42769076bb78c8f08b0f8e23555bfae65b7c6af42b174163e41

    SHA512

    cce27a566dea2b768010540898a2dfaaedf475f49fcd26f5a752b69afddcdb71994701891ee03f7f95ddc1b6ed72aac01e9c7eecde223d4332a842b02895390a

  • /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json

    Filesize

    718KB

    MD5

    9848f326eb31b8eb6a6aff56e08eaa6f

    SHA1

    475866a598c6c9d049f5ed2ffb3410d98edc7159

    SHA256

    f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779

    SHA512

    cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3