Analysis
-
max time kernel
2488853s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20-12-2023 06:43
General
-
Target
8c8806de862133ede2eddd2a82751af95eb39e0dd732478cc70baa5bb2d6ebdf.apk
-
Size
2.1MB
-
MD5
c4a118a1dd6dd7182329449cf4faa60a
-
SHA1
a36de5592e735ee578c24aedd0883e72c8eb95a5
-
SHA256
8c8806de862133ede2eddd2a82751af95eb39e0dd732478cc70baa5bb2d6ebdf
-
SHA512
77ade4851913d397ea238f60e42c7cdcbcadfc44ad67c6bdb805bf83e2b6146785a368f79ed8226489d86d0074fc5bd36c769f6ab2c87a21ec28a77a9f888ef4
-
SSDEEP
49152:LYYyEq32TvbIQ+cXIfivCm1Qh2PwYQyh4FYl0zfHFmErH8e/G:LYgTvn0tyh4Q6NS
Malware Config
Extracted
alienbot
http://oylebibokabattimben.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Checks Android system properties for emulator presence. 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
kaufcdbonmliysryrdoau.aerajrgbecibrzrydm.pyprsxmsyakxhhkug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kaufcdbonmliysryrdoau.aerajrgbecibrzrydm.pyprsxmsyakxhhkug/app_DynamicOptDex/ruX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/kaufcdbonmliysryrdoau.aerajrgbecibrzrydm.pyprsxmsyakxhhkug/app_DynamicOptDex/oat/x86/ruX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
495B
MD55933b43da6003ad15af7bc3fbd1b5d18
SHA14fef8f250700fa7bd5e611ae22bee407a6f5bb00
SHA256689a864a63c34adcfc2ab598823e26d6bba9b0e3ac783912c1b3ff78e2122426
SHA51297e0ec1d247042c798b735e41f1c9077d9b4b0f7e240565cc9880afb6f2aed1018d73f270e5b56c193bb965b4657d1ebc2589ef71db0eec2b451b19c2617c3a8
-
Filesize
700KB
MD5a0f1409eed47d0ae2644e2958bf604cf
SHA17de1e6a3b6a612a9c5d24f9261267d1c508e7d21
SHA256c1f32bb07764fd3d73bb0334ea9980d492143e6a5ffeec3c49a89928a9bf1f5e
SHA5122cc7067f7bc775ad8cec37395b8aea143bd4df8aca3281878ccdb1ac2fc6795e963e8a25a90be5158e375bd777d505e8bddb4a971423cb060f6ad2b13bb47bc0
-
Filesize
700KB
MD52598f9354762678916739e421d0446f4
SHA1af432cb2704286b815938d4c9f43611b24711879
SHA256c6b8cd75dd214186b8782a2c7a7f382913b40211258a0b9cc2932f5a69146491
SHA51218974a08e22cc356eb6ce3dfb8a847849dfb3caaf80ee941f9c7a70a90ff18510ebf45167c5b3c1584197f6e6d5e9cf40feaec5ba0db5ee6072a002439ede93a
-
Filesize
700KB
MD5c596c80c9a430118bb17ba7da35315ef
SHA1e4a8b897817a06ad8e9619cd55cab403db55f44d
SHA256980f5bb6824bf5fce9246a74ac76ef71e8a105103fb50d44d48b978966ee0c50
SHA512cc145eca6acea44a97dce8a791c13388edd2ab2ae3dd59742a1885f6b9672ec71d59e454ed7c88eaaf1b7a4daa2bcf77a1c2a524715112fc072b1340827d62c6