Overview

overview

10

Static

static

6

7b5f6d8b93...cf.apk

android-9-x86

10

7b5f6d8b93...cf.apk

android-10-x64

10

7b5f6d8b93...cf.apk

android-11-x64

10

Analysis

  • max time kernel
    2374202s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    20-12-2023 01:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b5f6d8b93d3dbe982f87be3988b7323cba198944e2afdc2b8143347fc17dbcf.apk

  • Size

    2.1MB

  • MD5

    29914c9b705f3446486261c1081aeccf

  • SHA1

    787c4a114cb1dc1ab91b93d35154b363778a8414

  • SHA256

    7b5f6d8b93d3dbe982f87be3988b7323cba198944e2afdc2b8143347fc17dbcf

  • SHA512

    b391917408018b5cf8e99d00462eeb08d9403a037458d0588e29d9d30b3dbd719d7ffa4a0c8118bbd24240c7440ae4edd979760263eb7f82ab33fedb5ac5b801

  • SSDEEP

    49152:PYO/q3NpOd3RHwTI8IrJjZ+VGw2PeOq/gf4tZL2w9HLXYHFmErJ28c9:PrEdcprJZ+1tT9LX4N2

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://apk-file.ru.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4246
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/oat/x86/eegd.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json
    Filesize

    756KB

    MD5

    575e54e078f15fc51f916be9fbb177ad

    SHA1

    6ad2701fdcccc7999e743d53e50fdf7763fe75a7

    SHA256

    79594c44226fc6772fb086d8a020204ad2540aaa5f4c9abca86b60ae000578c2

    SHA512

    ed8daeaf598c9b47709a266556104752166f068041c91822cf576ce81004e3f3313c398ea27be7e8feb7cb6e82f17cacf23baeb13b595a2125e7d4cf45fc1848

    Download Submit

  • /data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json
    Filesize

    756KB

    MD5

    c794df2a11248cb510f9f64aa64c8454

    SHA1

    34424960050861fae48c452631ab7327da72229c

    SHA256

    7a89cb0c9a118a79d6ccb404b9d853dccc875f5f531d2afafa56695222576a1a

    SHA512

    782692f5fe24883389509153a049d140b7344e79458566732b49c008e62692dd0dc6d95d7a7850dcc7a62a03684d67b28bc5415ba371b776e4b0c1008e6bfe7f

    Download Submit

  • /data/user/0/msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp/app_DynamicOptDex/eegd.json
    Filesize

    756KB

    MD5

    046daa6ef0e814210b639ed3920c1215

    SHA1

    c1329e6740a9a043dc330a855527359654c266f8

    SHA256

    34376c38cb4872e1e0d7708b5e4ef3d6c4e8ac1cc3c7cd407888a635661599cb

    SHA512

    9524a96ecaa2fb3421b2ba2ef076970abceb3c790b245f6eb033fa32db6b6d92d4e39b84a0af389ba80c9d2b75ada47dea78999e4bc1f007a09a377df628af81

    Download Submit