Analysis
-
max time kernel
2359283s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 04:55
General
-
Target
8586757efc2359fa24f98fb9cd3c42827aefea7e69fa568be38043aea4454576.apk
-
Size
2.1MB
-
MD5
f6bfa60529092c4b02cbb194ca1b90f1
-
SHA1
87f57d6783cc626ecd87d56a2ae6f0a5a51debaa
-
SHA256
8586757efc2359fa24f98fb9cd3c42827aefea7e69fa568be38043aea4454576
-
SHA512
3579de3d544473c47e2b6a0db9cc75e1f095b6be0fc8b7075755165e6cab9d8c48cabf9ee8b9fa786d992edd85eece7cd1359c1e979bff2e557cdacae570521e
-
SSDEEP
49152:kN1PNgSNd83DXd5AuytWc0D3l9zT074rIWQgAV1Y5AqYRsByL+:krlg6kn9AboH874rIWyXL+
Malware Config
Extracted
alienbot
http://saglamsiparislerburada.shop
Extracted
alienbot
http://saglamsiparislerburada.shop
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
com.scout.reopen1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5b36eb84093714d6fcff081b1593b811a
SHA16bd217666e550ebc28d0f81e09be88f37f4c1307
SHA256b8918f025b3e4d5c20a0c3d29ee1f087230d4cefbfd2eda86b6a1abdceabb821
SHA5123bfffdedf670499c9b041a608f25035ece4ab5f825d9709a650bd281991c5a4d434b45d4951e0d60bd5d55f1bc08dff1b0564ede32e4579d8c3d09d5b28d1077
-
Filesize
238KB
MD55ee1bede9feaba1e40b0e2ec6865d69f
SHA1a63af22b9b39f9cc6683026e0aed88407f8f561d
SHA256f4d58b7b70d2e60cf0e579bf068b49568862b7ae96d937fee8a12803aa59d914
SHA512ab1fb790f65ac993f419e4be1a1242264826707d9688aaf1287a6aaf937a11e5ea63279deb54dde0eea4abae0c09ce3509ac85d7580727d8547452afb920eedb
-
Filesize
375B
MD58056b705ddbc2660283376ce720fbbcd
SHA100eadd4f86958bea027c0239780d236471a89fa5
SHA2567009fdc17c8bedacc6059f380a82ed0059bfabc4e6e83b759b9c253bd48ca602
SHA512659728980b834819dfaf1b10f5e4b2307f770db7d7ca0a913bbad437429d285f2d30d2c0e81e33d81b52905206120a90cec907d8045d1b0c5bc31b3040e059a5
-
Filesize
482KB
MD5a75b81dbafbf0927c126004c729ca3c6
SHA16571802a07b56a9f7a75d1e184eb0f26e3e2a746
SHA2566333e8a28e7af5d55ba7c76c91a9f8ab2b542490f2a453deca6b8205b92ef131
SHA5125019bc1a52b8e2d826d125126ef879513d1b738ebc0ec687ce224d3854100513c964a85d0265d7e536cecdef2618e75411733495b2171ed070dc6f2f03d4f053