Analysis
-
max time kernel
2333501s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 02:30
General
-
Target
7de0af643b9888e7f2f9009b1d40d9b8bb445b343db5d30c608c0dec3b25311e.apk
-
Size
2.1MB
-
MD5
8d87534c81183f667ebae7692fe1f6f2
-
SHA1
d9c1722b76094fbf0b7d2b0cdedc48e21e0e23c8
-
SHA256
7de0af643b9888e7f2f9009b1d40d9b8bb445b343db5d30c608c0dec3b25311e
-
SHA512
09929777ea6cc452eaf35a937f9f92efd83d4d7c9f706ee67587e0193a531a882870bc6b91b5c7498e8e15ec07eb832c5881fff7bdc53273fe1054441a94cb10
-
SSDEEP
49152:MXZryfKnpo9UxQABmHfsyP+tNCxeE+yGJuyDh86xmdQgRwzl3M:Mprzn+QRm/syP+t8xOyGQyN86YQjM
Malware Config
Extracted
alienbot
http://ukalasey.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
xkzgysrhliupptxpgcaipwcmi.tfzlcjmfcdiqflssdy.jzxhfulszmwuqrbnnpixlroj1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
683KB
MD5db5f970aacf3d11f1fed71bbe6e8545e
SHA1f0f1ff174a669747d7b0feb83dbea502a71b1536
SHA25669ae58de202b7e2ba64c82927f07a89ec254d3f0c45594044a9e7d6d587a3018
SHA512ccbb672ae6d8241243be24329f1e004ee00cfa26ed0b059d8cee541d4da2d57b247af1ff44a21268ea91cbec9b99583af3bab71896014d94ad324b1eef0aec36
-
Filesize
683KB
MD5f005e3dbe7181044f0bbbe405e5fd6f0
SHA10c88d9ee32d2a9107a6c9270936c02668eb2526f
SHA25681eca1f21c16916c68228f64541c412b1d9570014a0dac71ac3aefad7e485c72
SHA5124016306ab99d8ac5a59bf100dea12dfed842dac85c528b2d51b29bc4bbb0cf8cc391c28046a665a23e7e7ea724d2c9bb0f163de06595cf8a51036896eb235868
-
Filesize
333B
MD588ac81c5ed17435a23e1695c28262f7c
SHA1e40bcf73f3f2bcf21cb2b78de04c15d90dda7fd1
SHA2560971be6e1a3386a9faa1bd188715803ea5d57f0e7133230185f68eca66ed2024
SHA512c4285da1d835085705a88ffcc56fa1a788fa0c383e005d355308146384cca9bb43e36f8be7802d06990ecfbb77145889d2486db83ca8793907357159706d7dfa