Overview

overview

10

Static

static

6

8484c2866f...59.apk

android-9-x86

10

8484c2866f...59.apk

android-10-x64

10

8484c2866f...59.apk

android-11-x64

10

Analysis

  • max time kernel
    2349873s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    20/12/2023, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8484c2866f4404efae683034430804680ec740b0919e435c3897ee45c3ae3759.apk
  • Size 1.8MB
  • Sample231220-e889gscbgl
  • SHA256 8484c2866f4404efae683034430804680ec740b0919e435c3897ee45c3ae3759
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

  • alienbot

C2

  • http://cacecarsa2.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 3 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • nziaryxzmcxobbploy.lufhis.fezdtho
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    PID:5061

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        aT.json
        • Path /data/data/nziaryxzmcxobbploy.lufhis.fezdtho/app_DynamicOptDex/aT.json
        • Size 710KB
        • SHA256 a72322c91ca9540aff284e9e46d2332870221cfd607792fb533a3eef142e9aca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aT.json
        • Path /data/data/nziaryxzmcxobbploy.lufhis.fezdtho/app_DynamicOptDex/aT.json
        • Size 710KB
        • SHA256 65655dd4a51322a416408aa47625afde37a7136d2cba45f2d7ca021ae15b5525
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aT.json.cur.prof
        • Path /data/data/nziaryxzmcxobbploy.lufhis.fezdtho/app_DynamicOptDex/oat/aT.json.cur.prof
        • Size 386B
        • SHA256 a5e983255bf8fe87066527f2ce3070ab4d03ad73fbb3443c3a88a1d8b9671e43
        • MD5 SHA1 SHA512
        Submit Download