Overview

overview

10

Static

static

6

8ef42748d5...01.apk

android-9-x86

10

8ef42748d5...01.apk

android-10-x64

10

8ef42748d5...01.apk

android-11-x64

10

Analysis

  • max time kernel
    2529121s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    20-12-2023 07:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ef42748d57d163c6c8f519cd663b6c8ef28d2f1afa527716cd2d40f4c4f5601.apk

  • Size

    1.8MB

  • MD5

    88982178e9df34bfcfd0b03d73c8c713

  • SHA1

    f33bcc2881f2fa274d2205dc23648449ceb23f61

  • SHA256

    8ef42748d57d163c6c8f519cd663b6c8ef28d2f1afa527716cd2d40f4c4f5601

  • SHA512

    3b85142303d1607e718b4658eed2ede5a3695af5a193d7a3f7c529df39d45fb9cd873989de171139296ef52ad0aeecc0507681790a858c77aa6cf77cb20cf910

  • SSDEEP

    49152:fml2hgZfDc2MsSeqW3u2Y0Cr6s1Bm2SOvxoewADrU1PE9sS:e2sKsDuQCrJLmnOYAvCPQsS

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://18likveletcalistiranusom.com

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Checks Android system properties for emulator presence. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4241
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt/app_DynamicOptDex/YieIMdU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt/app_DynamicOptDex/oat/x86/YieIMdU.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4267

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt/app_DynamicOptDex/YieIMdU.json
    Filesize

    710KB

    MD5

    4cfac28e6de420a67f47c16112a14ba5

    SHA1

    e92a353a9fc6764189fbf35b0eb011b8412aefe3

    SHA256

    9c31d977b4333bfe7727d1f44a2386685ea58dc7dc9e1eba6abd1d14c9404b2d

    SHA512

    c05cc9678e00952b47add83e4bcc5012e4542b9b4f99acfa3410ac1ce5b0216946965e4c00f7d59694165ff50f6c153356c23261a8a966f0bddf2c74d2d8debb

    Download Submit

  • /data/data/gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt/app_DynamicOptDex/YieIMdU.json
    Filesize

    710KB

    MD5

    1a2c6b59c2e35039736f07c45175793e

    SHA1

    106b97e48d61bb952d4b154bd91a38a6a6082ce0

    SHA256

    5e014f51504d2865151ca025a0660004cda6001e41fb82864059e365d69a0168

    SHA512

    aef8118e6ebf3084a4efe155788cc3e7a778b4af5fe9fb0a0edd102233cffdbdb4985d8c9846509d3f587dd3010b9a46fb0bab572370b8dab7c981d6074b392a

    Download Submit

  • /data/data/gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt/app_DynamicOptDex/oat/YieIMdU.json.cur.prof
    Filesize

    475B

    MD5

    5732c5ffe6a66e56c905716682c976ef

    SHA1

    41afe37ddbe132c2ab86853e3968fc56c1444025

    SHA256

    6a911ed43c14b0eada76a05617f10f04e241bd6535528f2f54d71a3d57ae0151

    SHA512

    6fff4fafefa2d2dba1b4a9654667f20068294218e7bf04123aebd53c6486d8ccdd79234a8464f4a4fc13b9aac831bba73ed593149402d8fed4ade6e511db0fc3

    Download Submit

  • /data/user/0/gyjjnzuynoytqwsbmheodkojrik.cgrgloxtlzzugaindmabhp.nmjegswkuutjtt/app_DynamicOptDex/YieIMdU.json
    Filesize

    710KB

    MD5

    c8e2dbb6120453be6d10895f51d1c811

    SHA1

    5f0415d52efb14dbc3bf94f42b17413633be3e14

    SHA256

    dec1d0902b9bee0edc72f21c025e13d2a25968a3118d07e02e16774450d1e689

    SHA512

    374fb0346ceb9bbc278dde08804b1f1bb78a6e108dac470442bd4d57a72f0ba842c58c64d05b73669e5618e2d5e1a65c013771373fd1a212d8c87c958bd03037

    Download Submit