Analysis
-
max time kernel
920337s -
max time network
155s -
platform
android_x64 -
resource
android-x64-arm64-20231023-en -
resource tags
-
submitted
04-12-2023 22:00
General
-
Target
23b3e076cdab5b50881f23a26a0f7d1d64b600ea5a8856da2a4f3adab81203a6.apk
-
Size
1.9MB
-
MD5
646587934709574ea4f9b1fab6e6a9bf
-
SHA1
49928e81110adc671b33191b49058709def46c07
-
SHA256
23b3e076cdab5b50881f23a26a0f7d1d64b600ea5a8856da2a4f3adab81203a6
-
SHA512
14797057550ee09330357c6793889cccb94680376f356221d2329582ac601f71631107d370cbfd42acdc0b2fd28caee1adc72b0cf565f9727864696af052b664
-
SSDEEP
49152:EZEf0UOWjhOs8KuVWU86zAIrw2xXA44udBaxC2qHhzG:E+cURAsoVWUbUIrwEXA44u3ax1ozG
Malware Config
Extracted
alienbot
http://bpargastasyas.ml
Extracted
alienbot
http://bpargastasyas.ml
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Removes its main activity from the application launcher 8 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.side.husband1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD55e3e44c7b57c1ec0357ea6890e91eb07
SHA1197f55b788d78f7e74861c31d05bf9eea285ad03
SHA25613a58f8173e217ce1a5b46d552ddfb3c3e2e04b6d7c44c6cd3a211b83850e061
SHA512b9414faab533bd6a7fe4e62217779b831e888f64182d7d43faa5a70e9cf27433daf7340305c3ecc9d905b887b9e818f37310729bae0a6d53e7b25cd059d7a35c
-
Filesize
238KB
MD5165cff3acd86133745c2bfbf7fea8f89
SHA1f507a90d90e19f8639c1f05bd0fbdc6dde975280
SHA256a8f157ac47912dfb4bab7c7895dbf6d7abe3b963e51f9062d66d92ce0ee832fc
SHA512a6a20013972c0e327264ea932911e4fa11dda795ebfdd8cb763b8beba6dab4b9766a669deb4bf707680d5a2cb1aaa8838948c98acaa9fbbf577b715c038733d8
-
Filesize
483KB
MD58ea5dae61ca0889417db86ff26fea3ee
SHA185c9bc2f074bc5450af76d0acafb1f27939e22b9
SHA25669c7ae04bc1ecc5217f1a3eef149382edc589ce183d4b5062193c2f8974c7690
SHA512c55fdaf2af279a525b507e2a7aa2d2a5e771bcb872fb8ce4eeca626078475f45b8135b91a6de21ebfa89fd0fdc5f3e4a88551bf21b0b446437bfefcab5c2abe1
-
Filesize
321B
MD5ef7c8229d637843bc86fc7199dbbd54d
SHA19f04941de5e96e6f515d77080c70c495a470bb0e
SHA25633f4abb01dae37691631aa2c8bacabb7d176f805afef35f4902eb5865bf85de0
SHA5121325209e22f5db63f4a9791ee6e7b3355b389358b91b3f4d7b36372007f655961e7223910b08622dacb23fa6b063edb741bbd5114203dda0f2145f7e4e3802bd