Analysis
-
max time kernel
2300241s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 02:29
General
-
Target
7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82.apk
-
Size
2.4MB
-
MD5
3516d7b0d815d8c48dd6785c1b885e4c
-
SHA1
af9d581f7ab4871c6dde28e0bd277ac370e67396
-
SHA256
7dcb987d39106ebb91cde38cdb87e43377963014722a4d49b2c49370ad54ae82
-
SHA512
ddcedf17501d7c5fd004c32d377cf8429bc116acda3c9b5ab0928f757072bd7a7e75b050d601f3fd18549bb5804373d047704c68763beaaaf6c31e1b15c10040
-
SSDEEP
49152:i6WLvEZiJwF2RF0t+XwSCiS8ckt2fd6yQW1s6/GNsTZZZZdZROlGNkWFBJdfSbHu:5NdNiS8cOXcG0ZZZZdX6W/Jdf1
Malware Config
Extracted
alienbot
http://perohi21.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
lkwzr.nqbmmkomdijrxzuyzhmqtsz.bmpczafrei1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD59a50331ca013d3490f29a6d332394abb
SHA10a41cedc0a8288a2ba1b8ec2c8fcc48ccc061fcb
SHA256136a06e4d715455a817a70ab6b8162e187b224e11041a73b5e14e9ea6d8d3551
SHA512d004b02652ae4c260aaa71fc6a771fd1e4281166e24860f5db34e0bc8f38de826220064325ecde28fd4824d6c0a05b6b8f7dac3e3de5f551c45a645f949d1398
-
Filesize
741KB
MD55eec4c66cd3b761348a9a8dc665afd6a
SHA1f1d8c01316c5d522ff2e1847835a6b5ee8cd50bb
SHA256ee39b5b0bd3584c8e5ee8ac84e97887323f7cb7fb336b3c54fac18b7e8f20747
SHA512319cfba47d0111c02de98454c64931d1e7827aa8a2912d6d836f52d6bf0ef710ed9ca4ef8aa51eab18e1467ada87a1ca7c072bbacde4d04607a7317146e396be
-
Filesize
336B
MD5a502ff6a918192b9976367f885998991
SHA1927f10bac232b82d8b3547eb5079e3469b39ff57
SHA256e1cf7b8151d74d9ab8b8c4d19c9f83a9143073f6818a1d7b9194765c61488e24
SHA512be41800115bb76ad5715f1dcc6a6fd50c78be1aa86c6039249aac2169e95a27b6f35462ac2fc45eea8ea468bac511025041466275b96fe9b249fb584f76fe591