Overview

overview

10

Static

static

7

base.apk

android-9-x86

10

base.apk

android-10-x64

10

base.apk

android-11-x64

10

Analysis

  • max time kernel
    3355927s
  • max time network
    140s
  • platform
    android_x86
  • resource
    android-x86-arm-20231023-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
  • submitted
    13-11-2023 09:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    base.apk

  • Size

    2.2MB

  • MD5

    f962034252259d770995b760cf804ed4

  • SHA1

    92a4967469877bb134e81bdaec0a8a1171c79dc6

  • SHA256

    28cf23f76582b13705346e8fe77802785267e6b2ab2072bf9c2b9b918b2b588b

  • SHA512

    7a96a65c09cf73689c041b8a4de219c6fef2a1b824efa925baf9b6afe2a8ed314c044d631d6106d30df69b5b1c593949516668650c25fbc80921f1afeeb33c7c

  • SSDEEP

    49152:K7wyceKi6ssGECKmviJRpLof9/n39pdRxOKTH1luTdMS:5ZLmE9AQnLUF3HMKTHSdX

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://comolokko4152ertausicken.gq/

rc4.plain

Extracted

Family

alienbot

C2

http://comolokko4152ertausicken.gq/

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.timber.funny
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4261
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.timber.funny/app_DynamicOptDex/oat/x86/oQXZESo.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.timber.funny/app_DynamicOptDex/oQXZESo.json
    Filesize

    238KB

    MD5

    b9ef71e496c13f1d0adb890f09b0a6ac

    SHA1

    a0b768653d33a43094ec5d325fd14169f8e2943f

    SHA256

    2681dd696c408d25daecaa524b7ea7a8491e94cdc8c7e41f96de5650bba91e80

    SHA512

    189eb39f1b89a0768e5ad524289688a8bcddb7be1d84cdb9cf7eae9ea01a40a69207bbbd14d71a5bed0c38726726cc7ff4fb3ebe0e751817ac21f8bdce4c072e

    Download Submit

  • /data/data/com.timber.funny/app_DynamicOptDex/oQXZESo.json
    Filesize

    238KB

    MD5

    27fba65ca18b132e52e55df1dc2d710a

    SHA1

    45e418b090bbaa73751145cd003ec18d91d68a10

    SHA256

    72147d67aefb8b20893ff3f22f75d449a29b56d67d0a4fdda255187f6a5885a7

    SHA512

    1f50c7bc719dbccb6ef74a5a56c02681e222b8ecd88347e2dad57d675a8c8c624e6cc7f62699d2b7362e9b57ff24c994a5c5699c4190f910555568916b0249f2

    Download Submit

  • /data/data/com.timber.funny/app_DynamicOptDex/oat/oQXZESo.json.cur.prof
    Filesize

    486B

    MD5

    0638e9065ffd917108b24dbbffe8b9a7

    SHA1

    c3ea6e8dcfa401afdf2d7f78fc63acf45e3e7eab

    SHA256

    ce7aae2635bb1cfd608d14de7ba00a1d46e8005f3f12c140b245ed7ecc21c648

    SHA512

    a053447f177bafb1efcff8de864eaaa731552d2a036d6a59e99a3cffa82e97f75ff87131bb252c809d7f333897cd2b5ccd5ec35533a7f248868626c925426a36

    Download Submit

  • /data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json
    Filesize

    483KB

    MD5

    cd68bd369ad3a243d685c016f4488780

    SHA1

    7e595a755c12a440d35f37bebb968c25032ff3f9

    SHA256

    c9ffe96e34b133ef1688d93e51e7d8340f52f6f62cc33121997086313604fb9a

    SHA512

    0c4c565d5da0cfec92b1ba33475522c74b8e9faacbd29d2b09d1f4daafdc0c5a70517094278f6c311026785a5e51876346dd623ce2ea0974ded69108c93c57a5

    Download Submit

  • /data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json
    Filesize

    483KB

    MD5

    09485d0ae12ab18d75eb0ca54efbf49c

    SHA1

    f2daa5007a2479ee78c74e8f9eb013b946b9962d

    SHA256

    bc51d9fc51b0045e126dbb438b481b6808218cde64ec3fb51d3267d3212f79c4

    SHA512

    8d94715a8c019914628e911658ce1f17df8924c76d3e963004891040953c8c51d514cc89f9029a00119b0a06e7cb38830e5287096426e0399095c49622398be4

    Download Submit