Overview

overview

10

Static

static

7

base.apk

android-9-x86

10

base.apk

android-10-x64

10

base.apk

android-11-x64

10

Analysis

  • max time kernel
    3355947s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231023-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
  • submitted
    13-11-2023 09:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    base.apk

  • Size

    2.2MB

  • MD5

    f962034252259d770995b760cf804ed4

  • SHA1

    92a4967469877bb134e81bdaec0a8a1171c79dc6

  • SHA256

    28cf23f76582b13705346e8fe77802785267e6b2ab2072bf9c2b9b918b2b588b

  • SHA512

    7a96a65c09cf73689c041b8a4de219c6fef2a1b824efa925baf9b6afe2a8ed314c044d631d6106d30df69b5b1c593949516668650c25fbc80921f1afeeb33c7c

  • SSDEEP

    49152:K7wyceKi6ssGECKmviJRpLof9/n39pdRxOKTH1luTdMS:5ZLmE9AQnLUF3HMKTHSdX

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://comolokko4152ertausicken.gq/

rc4.plain

Extracted

Family

alienbot

C2

http://comolokko4152ertausicken.gq/

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.timber.funny
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4424
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4548
      • getprop ro.miui.ui.version.name
        2⤵
          PID:4635
        • getprop ro.miui.ui.version.name
          2⤵
            PID:4760
          • getprop ro.miui.ui.version.name
            2⤵
              PID:4804
            • getprop ro.miui.ui.version.name
              2⤵
                PID:4836
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:4866
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:4892

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json
                  Filesize

                  238KB

                  MD5

                  b9ef71e496c13f1d0adb890f09b0a6ac

                  SHA1

                  a0b768653d33a43094ec5d325fd14169f8e2943f

                  SHA256

                  2681dd696c408d25daecaa524b7ea7a8491e94cdc8c7e41f96de5650bba91e80

                  SHA512

                  189eb39f1b89a0768e5ad524289688a8bcddb7be1d84cdb9cf7eae9ea01a40a69207bbbd14d71a5bed0c38726726cc7ff4fb3ebe0e751817ac21f8bdce4c072e

                  Download Submit

                • /data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json
                  Filesize

                  238KB

                  MD5

                  27fba65ca18b132e52e55df1dc2d710a

                  SHA1

                  45e418b090bbaa73751145cd003ec18d91d68a10

                  SHA256

                  72147d67aefb8b20893ff3f22f75d449a29b56d67d0a4fdda255187f6a5885a7

                  SHA512

                  1f50c7bc719dbccb6ef74a5a56c02681e222b8ecd88347e2dad57d675a8c8c624e6cc7f62699d2b7362e9b57ff24c994a5c5699c4190f910555568916b0249f2

                  Download Submit

                • /data/user/0/com.timber.funny/app_DynamicOptDex/oQXZESo.json
                  Filesize

                  483KB

                  MD5

                  09485d0ae12ab18d75eb0ca54efbf49c

                  SHA1

                  f2daa5007a2479ee78c74e8f9eb013b946b9962d

                  SHA256

                  bc51d9fc51b0045e126dbb438b481b6808218cde64ec3fb51d3267d3212f79c4

                  SHA512

                  8d94715a8c019914628e911658ce1f17df8924c76d3e963004891040953c8c51d514cc89f9029a00119b0a06e7cb38830e5287096426e0399095c49622398be4

                  Download Submit

                • /data/user/0/com.timber.funny/app_DynamicOptDex/oat/oQXZESo.json.cur.prof
                  Filesize

                  319B

                  MD5

                  2884231a028bd7d1e42b07023a88d22c

                  SHA1

                  0a56432a214cc10b5b5fc8ddefbff74c602c9442

                  SHA256

                  93d581db0face5a81e1005e9df216a122132f2a4507efa2d6afa081a643725fb

                  SHA512

                  4920e71ed460fb4ed44fc13433a4bde9d813460ccb34a52ee4af8409c69f04e9b0e1ea2d41a4c59110421dbbe5fbd9e9bc04ca8aea6d1cae889d625d8478d777

                  Download Submit