Analysis
-
max time kernel
2440667s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 08:15
General
-
Target
93d77923edd54c80a9073ab529daa34e275334eea747daf3f496bce114116545.apk
-
Size
2.5MB
-
MD5
53cfbd65d6f0beec535d5c11b7b8ee68
-
SHA1
0e10eef11b6b6e9c1b81a0719f64ef4a85d68f8a
-
SHA256
93d77923edd54c80a9073ab529daa34e275334eea747daf3f496bce114116545
-
SHA512
92d8a47acf00065842903bab4ba4036e4b579c82f8215279a2e7fb55678b91490cfa6b7f2f52edcd902151ce80e30ca1ca28f886ac09267b1969ef7285e20061
-
SSDEEP
49152:/fTEOHkiXkXbOrT8KnIjyKVGwG2T0eZrmNGKqviEQxriESscXHKaj9aaxmIqmgLF:nTwbATZOkw0GmYKpZ6pfYLNmIJ3Rf
Malware Config
Extracted
alienbot
http://brobenim9.site
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 5 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
pact.praise.duty1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320B
MD5b845c388b337b99cfa5af45e58540301
SHA10efcf21014df40fb9afe35a75a26d2ae33d15737
SHA256d739e4d26c3414f5a83d1fd72167cc605baad25258a3b11df8de9ea9c7860bb2
SHA5120e9c8bdc5e2fe3fedce97dc8d795c0acf913c4d4ce86054301b18962cdd206dc0f4aa42d13785a038a07306855fb0e58674c01b0ac82d9496fa0ce189f856b21
-
Filesize
770KB
MD5ef752c7eb8f3ca6848e22402d62eb323
SHA15f17225fdb4dfbc185ccf5dec24786f4596ade1d
SHA2562c8c25001ed0b6d8e9ed5bb4ef31a6e1b464d042c5f6ab758a7d248f065f3aee
SHA512edcb038621a1c710ceb6512c86d165bf0005a3de9064ef64ef9ca113ab0c4bab8b39e72342ef2f99c2b9e5924bcd36faf8414fcf70065240509489fc75a5b6e3
-
Filesize
770KB
MD528661ee5d491cd59cd65233484056f82
SHA1ce56c25dff73fb8cfe2f644566126713d762d83d
SHA2567391ae613d0971120572a9c1f351a7088e1b0796920472758fec3449bbfc9e00
SHA512f8f04701405f4289706028d1c267f290f386714eedfc789229b12c34a885cbbaa269eeaedc01d2f92570e00238a414a7749a58bc42c1269a29724b1254891eb6