Overview
overview
10Static
static
77142344ff1...b0.apk
android-9-x86
107142344ff1...b0.apk
android-10-x64
107142344ff1...b0.apk
android-11-x64
10aps-mraid.js
windows7-x64
1aps-mraid.js
windows10-2004-x64
1calendar1.html
windows7-x64
1calendar1.html
windows10-2004-x64
1circle1.html
windows7-x64
1circle1.html
windows10-2004-x64
1dtb-m.js
windows7-x64
1dtb-m.js
windows10-2004-x64
1fyb_iframe...l.html
windows7-x64
1fyb_iframe...l.html
windows10-2004-x64
1fyb_static...l.html
windows7-x64
1fyb_static...l.html
windows10-2004-x64
1libc763d2.so
ubuntu-18.04-amd64
libc763d2.so
debian-9-armhf
libc763d2.so
debian-9-mips
libc763d2.so
debian-9-mipsel
Analysis
-
max time kernel
2796287s -
max time network
165s -
platform
android_x64 -
resource
android-x64-20231023.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system -
submitted
06-11-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
aps-mraid.js
Resource
win7-20231025-en
Behavioral task
behavioral5
Sample
aps-mraid.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
calendar1.html
Resource
win7-20231020-en
Behavioral task
behavioral7
Sample
calendar1.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
circle1.html
Resource
win7-20231023-en
Behavioral task
behavioral9
Sample
circle1.html
Resource
win10v2004-20231025-en
Behavioral task
behavioral10
Sample
dtb-m.js
Resource
win7-20231020-en
Behavioral task
behavioral11
Sample
dtb-m.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
fyb_iframe_endcard_tmpl.html
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
fyb_iframe_endcard_tmpl.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
fyb_static_endcard_tmpl.html
Resource
win7-20231020-en
Behavioral task
behavioral15
Sample
fyb_static_endcard_tmpl.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
libc763d2.so
Resource
ubuntu1804-amd64-20231026-en
Behavioral task
behavioral17
Sample
libc763d2.so
Resource
debian9-armhf-20231026-en
Behavioral task
behavioral18
Sample
libc763d2.so
Resource
debian9-mipsbe-20231026-en
Behavioral task
behavioral19
Sample
libc763d2.so
Resource
debian9-mipsel-20231026-en
General
-
Target
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0.apk
-
Size
3.1MB
-
MD5
b1f4cb2c134e42e1c26f333097e17e56
-
SHA1
7fcfc163fe3f8bf5a54e38fe21ce559d6cafcd40
-
SHA256
7142344ff1efa338898a69da6c5081007223717b01b3f4d6207cecb9f646aab0
-
SHA512
c058f040f08f8ecd89498d0b86d24e6519cb7d46d594e50adcff54d08419eb025d49c3be1cdb4b5362800a574e67c33712046d927c06853f3f54f409aa503783
-
SSDEEP
49152:h7KMzjB309sF4vt5HW7zDC4SvQvM2rIg5ZNMErWfPzODZTq81hSjA3y:FKck6mV5mCgvM2rT5NrLlBjEAi
Malware Config
Extracted
alienbot
http://buuncanlidersvarmi11.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload 3 IoCs
Processes:
resource yara_rule /data/data/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json family_cerberus -
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
chef.isolate.taskdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId chef.isolate.task Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId chef.isolate.task -
Processes:
chef.isolate.taskpid process 5053 chef.isolate.task 5053 chef.isolate.task 5053 chef.isolate.task -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
chef.isolate.taskioc pid process /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json 5053 chef.isolate.task /data/user/0/chef.isolate.task/app_DynamicOptDex/fTnEmT.json 5053 chef.isolate.task
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
718KB
MD5941798c87bc19acf81e9a30c5c9d342d
SHA19c729d4edf25fdebabe911858ac4d51551946284
SHA25689418d37f636411e97486c68de47965757b31da3a0b481979865c8efb5804fec
SHA512d803a09f708f2834f683a22d3077b41d6b7cc512ba41f777ecde4670d2bc63b4a357ff06699e530bf4c3fdbf0b6fd10a6c33e6c8e4b8015955724bfb3fb19cc0
-
Filesize
718KB
MD59848f326eb31b8eb6a6aff56e08eaa6f
SHA1475866a598c6c9d049f5ed2ffb3410d98edc7159
SHA256f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779
SHA512cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3
-
Filesize
475B
MD58de620c78836dccee1eb1ada7efb42c0
SHA102ce40766bd8f0f9b15033e7f9da16f2ddf5624a
SHA25684d23c496050ca17c1336074f21e9f4d48d86c9fe6266246585dce23359b3ab2
SHA512f6c8903f901f846c903107a52d9278802663317160d44bb9f42af7eebde5d1205cc421da33a8066d538726bebf00afb44cfb14249ad1be4f28ab094f52a557f8
-
Filesize
718KB
MD59848f326eb31b8eb6a6aff56e08eaa6f
SHA1475866a598c6c9d049f5ed2ffb3410d98edc7159
SHA256f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779
SHA512cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3
-
Filesize
718KB
MD59848f326eb31b8eb6a6aff56e08eaa6f
SHA1475866a598c6c9d049f5ed2ffb3410d98edc7159
SHA256f49be7fe820c785aef3578b113a3240e8450c797609578b6d05316cbb3495779
SHA512cff258de266dd100a77768560bd0e013c25d73ea46630f37dde7c8f3731d95128c99cdbe424379bed655aee20fe9187f37699f1966b5157aee2047d6127003a3