Analysis
-
max time kernel
1368481s -
max time network
136s -
platform
android_x64 -
resource
android-x64-20231023.1-en -
resource tags
-
submitted
10-12-2023 02:29
General
-
Target
23b3e076cdab5b50881f23a26a0f7d1d64b600ea5a8856da2a4f3adab81203a6.apk
-
Size
1.9MB
-
MD5
646587934709574ea4f9b1fab6e6a9bf
-
SHA1
49928e81110adc671b33191b49058709def46c07
-
SHA256
23b3e076cdab5b50881f23a26a0f7d1d64b600ea5a8856da2a4f3adab81203a6
-
SHA512
14797057550ee09330357c6793889cccb94680376f356221d2329582ac601f71631107d370cbfd42acdc0b2fd28caee1adc72b0cf565f9727864696af052b664
-
SSDEEP
49152:EZEf0UOWjhOs8KuVWU86zAIrw2xXA44udBaxC2qHhzG:E+cURAsoVWUbUIrwEXA44u3ax1ozG
Malware Config
Extracted
alienbot
http://bpargastasyas.ml
Extracted
alienbot
http://bpargastasyas.ml
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 5 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
com.side.husband1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD55e3e44c7b57c1ec0357ea6890e91eb07
SHA1197f55b788d78f7e74861c31d05bf9eea285ad03
SHA25613a58f8173e217ce1a5b46d552ddfb3c3e2e04b6d7c44c6cd3a211b83850e061
SHA512b9414faab533bd6a7fe4e62217779b831e888f64182d7d43faa5a70e9cf27433daf7340305c3ecc9d905b887b9e818f37310729bae0a6d53e7b25cd059d7a35c
-
Filesize
238KB
MD5165cff3acd86133745c2bfbf7fea8f89
SHA1f507a90d90e19f8639c1f05bd0fbdc6dde975280
SHA256a8f157ac47912dfb4bab7c7895dbf6d7abe3b963e51f9062d66d92ce0ee832fc
SHA512a6a20013972c0e327264ea932911e4fa11dda795ebfdd8cb763b8beba6dab4b9766a669deb4bf707680d5a2cb1aaa8838948c98acaa9fbbf577b715c038733d8
-
Filesize
451B
MD5a81fc2ea0e693a31e3486db0328af429
SHA16355a06b9ceb6f407794be460328a808e80f5ac0
SHA256b838fd2b8d36df3b407674b20b608545cd36089255527e7c609f2aea5341671f
SHA51296a8f62c1fce7aca613f6d6fba166dd291985b27ec0c4eb3d75394f533a3d5566cf483195444aa6a32de150a62cc9f0c5f15d6c8266c39f655fe972bc6e581d1
-
Filesize
483KB
MD58ea5dae61ca0889417db86ff26fea3ee
SHA185c9bc2f074bc5450af76d0acafb1f27939e22b9
SHA25669c7ae04bc1ecc5217f1a3eef149382edc589ce183d4b5062193c2f8974c7690
SHA512c55fdaf2af279a525b507e2a7aa2d2a5e771bcb872fb8ce4eeca626078475f45b8135b91a6de21ebfa89fd0fdc5f3e4a88551bf21b0b446437bfefcab5c2abe1