Analysis
-
max time kernel
2341530s -
max time network
147s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20/12/2023, 02:30
General
-
Target
7dde3353e679bd4ec0a5c8655d95edb9a41e2a6c284ece79e764fe91a709ba14.apk
-
Size
2.3MB
-
MD5
dafe74f89d07bb8e452506809920ceb8
-
SHA1
449270d46ff82f62edd095a967b0751e62b4054f
-
SHA256
7dde3353e679bd4ec0a5c8655d95edb9a41e2a6c284ece79e764fe91a709ba14
-
SHA512
243ff9a864b66c46a8202b90b4d3d899f16d4953a91414c83024a6366f286c1e55bbacc80bbaa1370e42fbaf3050ca614164ade64c69175ec8c19bed2cf4153a
-
SSDEEP
49152:x1qxruZUjBQLYhdo3bHDzFUYmQLcVXzRsoP8geg2QW/I9WkNU66SuhKmub7CyfGm:9iS+ibl9mlRWINTp9fp
Malware Config
Extracted
alienbot
http://abracadabra6.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Checks Android system properties for emulator presence. 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
lrjdwnlfnrsjrh.kqtxlpsdmqlkxxre.xlpgxysehcskiwbrwaurejlwkm1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/lrjdwnlfnrsjrh.kqtxlpsdmqlkxxre.xlpgxysehcskiwbrwaurejlwkm/app_DynamicOptDex/WRX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/lrjdwnlfnrsjrh.kqtxlpsdmqlkxxre.xlpgxysehcskiwbrwaurejlwkm/app_DynamicOptDex/oat/x86/WRX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
693KB
MD5546fddb6ce5bd49be50961bf31a27e03
SHA19e8fbff72bbf0e3edf149f8f12f8c3d3e8088cc6
SHA256ec6677ae919129722c52feabe29df80c12a4347beb4be48fc3a16576f3d13da1
SHA5126294cd3af8b8e1d3c26ddd8a0934f0a0e8948fc3835757f966378f6accd1f168d2bf009a104c9a73dc212da4c69c4d698d2aa8078c3b943d081d724e3acdc048
-
Filesize
693KB
MD5a0ec4b3560a4645b42091707b6edf989
SHA18fdf10e8a1159e78f2ac2fecfa5dfedf9cc5f0a7
SHA256b9ac8c63c12276732e00ee9506b582f816dca0a5d08978c27917f94ff8c1bc70
SHA512f6fb020f2da9a7e4eac2affcfebf4440e4d0998c3994ffa1dffe6d0eed703e15d04ee9a6feded726f349deb413f90e7ff013f04c16a780f13bb33b678b6c1e28
-
Filesize
500B
MD5a8ed81c7b50d7ef988bf88e7906565de
SHA19f549fad753db19459bf09f720cda921bff1401b
SHA256628f0830987b2cfbb6ab5ca524e75d4f2448c04002f88faf489d222b7b2d05e5
SHA512cdf6b4c0e03add4169ab3189e420223a4b65e72d1f18b985e3620a4eed392e28548c4f37b3d074d2036ca06a2a2b583750320e6c57682ccf3a84b08b08c6046b
-
Filesize
693KB
MD5c529677c9530128ad96c250379d349e3
SHA1544c59a4cbb26a8c4e073d8a672800ef72a8ae85
SHA2566f9e9e5f374db6c828b485f2428902b3c07270b9482853c6d98aef36158467e4
SHA512addc5b29b3796a492a245d5b14bcf557c818816e9910d3cb8caf460d9a0ab94cb5ac921a4250367606e6afb3171cd49b87305d75e8843cdb59ea46cb4cfbc6e8