Analysis
-
max time kernel
2378058s -
max time network
131s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 06:43
General
-
Target
8c8806de862133ede2eddd2a82751af95eb39e0dd732478cc70baa5bb2d6ebdf.apk
-
Size
2.1MB
-
MD5
c4a118a1dd6dd7182329449cf4faa60a
-
SHA1
a36de5592e735ee578c24aedd0883e72c8eb95a5
-
SHA256
8c8806de862133ede2eddd2a82751af95eb39e0dd732478cc70baa5bb2d6ebdf
-
SHA512
77ade4851913d397ea238f60e42c7cdcbcadfc44ad67c6bdb805bf83e2b6146785a368f79ed8226489d86d0074fc5bd36c769f6ab2c87a21ec28a77a9f888ef4
-
SSDEEP
49152:LYYyEq32TvbIQ+cXIfivCm1Qh2PwYQyh4FYl0zfHFmErH8e/G:LYgTvn0tyh4Q6NS
Malware Config
Extracted
alienbot
http://oylebibokabattimben.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 5 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
kaufcdbonmliysryrdoau.aerajrgbecibrzrydm.pyprsxmsyakxhhkug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
361B
MD524c8c87be4c8a589d0ec8354d6428692
SHA16df0354e62d4a51d7a8ad81cc7b57fbfe1f6e8d2
SHA256b20be5488b042d7d645819563955fc1cbfc5d12636fe15b2c2d0fbdc022807f1
SHA512e0768db4c31aa90038deeb42ac1709fef8693d5e5aad5cb13eeeeec090c7df251656e752d0d8ea22668f38f3366555b009be74693ac4cbe27d17d84ec7cd0c94
-
Filesize
700KB
MD5a0f1409eed47d0ae2644e2958bf604cf
SHA17de1e6a3b6a612a9c5d24f9261267d1c508e7d21
SHA256c1f32bb07764fd3d73bb0334ea9980d492143e6a5ffeec3c49a89928a9bf1f5e
SHA5122cc7067f7bc775ad8cec37395b8aea143bd4df8aca3281878ccdb1ac2fc6795e963e8a25a90be5158e375bd777d505e8bddb4a971423cb060f6ad2b13bb47bc0
-
Filesize
3KB
MD5aac9c48b461ad4b5154608173c56da4c
SHA18fdabf2c08b493f980ee5a57f4334579e161de17
SHA256e62c957be804af5661390684d391f73a02ec7bbdfb175ce47a478c27b3fd6e1e
SHA51265f1b2474135e94184e519ec3a139239e6aee16628b4577a18fb00e028c0d2d6d4eb2c0c94089350603a66fd8c2a939775295484425c5b1a6d664b58e5c1ddad
-
Filesize
700KB
MD52598f9354762678916739e421d0446f4
SHA1af432cb2704286b815938d4c9f43611b24711879
SHA256c6b8cd75dd214186b8782a2c7a7f382913b40211258a0b9cc2932f5a69146491
SHA51218974a08e22cc356eb6ce3dfb8a847849dfb3caaf80ee941f9c7a70a90ff18510ebf45167c5b3c1584197f6e6d5e9cf40feaec5ba0db5ee6072a002439ede93a