Analysis
-
max time kernel
2328829s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 01:50
General
-
Target
7b5f6d8b93d3dbe982f87be3988b7323cba198944e2afdc2b8143347fc17dbcf.apk
-
Size
2.1MB
-
MD5
29914c9b705f3446486261c1081aeccf
-
SHA1
787c4a114cb1dc1ab91b93d35154b363778a8414
-
SHA256
7b5f6d8b93d3dbe982f87be3988b7323cba198944e2afdc2b8143347fc17dbcf
-
SHA512
b391917408018b5cf8e99d00462eeb08d9403a037458d0588e29d9d30b3dbd719d7ffa4a0c8118bbd24240c7440ae4edd979760263eb7f82ab33fedb5ac5b801
-
SSDEEP
49152:PYO/q3NpOd3RHwTI8IrJjZ+VGw2PeOq/gf4tZL2w9HLXYHFmErJ28c9:PrEdcprJZ+1tT9LX4N2
Malware Config
Extracted
alienbot
http://apk-file.ru.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
msbtomsqwhedxxjofjtuncgsses.nqunxowwntnu.cbgseqrfp1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD5575e54e078f15fc51f916be9fbb177ad
SHA16ad2701fdcccc7999e743d53e50fdf7763fe75a7
SHA25679594c44226fc6772fb086d8a020204ad2540aaa5f4c9abca86b60ae000578c2
SHA512ed8daeaf598c9b47709a266556104752166f068041c91822cf576ce81004e3f3313c398ea27be7e8feb7cb6e82f17cacf23baeb13b595a2125e7d4cf45fc1848
-
Filesize
756KB
MD5c794df2a11248cb510f9f64aa64c8454
SHA134424960050861fae48c452631ab7327da72229c
SHA2567a89cb0c9a118a79d6ccb404b9d853dccc875f5f531d2afafa56695222576a1a
SHA512782692f5fe24883389509153a049d140b7344e79458566732b49c008e62692dd0dc6d95d7a7850dcc7a62a03684d67b28bc5415ba371b776e4b0c1008e6bfe7f
-
Filesize
362B
MD5c358f5d7057ea66e9d8694822d99a359
SHA140756683c1b130f095eaa002164c90528a2ed378
SHA2569efb9152609f8393d861e91d3209689c23dbc2600b9b5fe90d6d5d565d16b3d8
SHA512a984c53d066beb7d205120c19cddab50cd5a2d005653d8d6d7a3dbf461f50427bf9c74f47c05ceba7d86328a7eae83fdf70f646106df0e9aa49271017468ed0f