Analysis
-
max time kernel
2333558s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 02:30
General
-
Target
7de0af643b9888e7f2f9009b1d40d9b8bb445b343db5d30c608c0dec3b25311e.apk
-
Size
2.1MB
-
MD5
8d87534c81183f667ebae7692fe1f6f2
-
SHA1
d9c1722b76094fbf0b7d2b0cdedc48e21e0e23c8
-
SHA256
7de0af643b9888e7f2f9009b1d40d9b8bb445b343db5d30c608c0dec3b25311e
-
SHA512
09929777ea6cc452eaf35a937f9f92efd83d4d7c9f706ee67587e0193a531a882870bc6b91b5c7498e8e15ec07eb832c5881fff7bdc53273fe1054441a94cb10
-
SSDEEP
49152:MXZryfKnpo9UxQABmHfsyP+tNCxeE+yGJuyDh86xmdQgRwzl3M:Mprzn+QRm/syP+t8xOyGQyN86YQjM
Malware Config
Extracted
alienbot
http://ukalasey.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
xkzgysrhliupptxpgcaipwcmi.tfzlcjmfcdiqflssdy.jzxhfulszmwuqrbnnpixlroj1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
683KB
MD5db5f970aacf3d11f1fed71bbe6e8545e
SHA1f0f1ff174a669747d7b0feb83dbea502a71b1536
SHA25669ae58de202b7e2ba64c82927f07a89ec254d3f0c45594044a9e7d6d587a3018
SHA512ccbb672ae6d8241243be24329f1e004ee00cfa26ed0b059d8cee541d4da2d57b247af1ff44a21268ea91cbec9b99583af3bab71896014d94ad324b1eef0aec36
-
Filesize
683KB
MD5f005e3dbe7181044f0bbbe405e5fd6f0
SHA10c88d9ee32d2a9107a6c9270936c02668eb2526f
SHA25681eca1f21c16916c68228f64541c412b1d9570014a0dac71ac3aefad7e485c72
SHA5124016306ab99d8ac5a59bf100dea12dfed842dac85c528b2d51b29bc4bbb0cf8cc391c28046a665a23e7e7ea724d2c9bb0f163de06595cf8a51036896eb235868
-
Filesize
393B
MD5be8921ddd5b2261736599a5cf0d974d4
SHA1112a02121ce8017c2cff983023eb063ecfc5f78a
SHA2566fca35c3590e166cdedc71d58aadf2fa9208fa583f32efdd699893b30c95f55d
SHA5127f9701e428d98dff1b20418d6d39b7a89199dfe4c42b03aae2375a4473d6af100988773a7908fd3370c46d7eb71b11ebc323aeec058df91358eef9d5c0f99fc1