Analysis
-
max time kernel
2435875s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 08:36
General
-
Target
969178a180044391688e9a9b33a402af2d09b25c04126ff110ca9b90c36055c0.apk
-
Size
2.0MB
-
MD5
33a0329471bc89336a569b389d0c3f58
-
SHA1
2bb7d2bbdb97252d1d7df50d15677f6c2c1f0818
-
SHA256
969178a180044391688e9a9b33a402af2d09b25c04126ff110ca9b90c36055c0
-
SHA512
4e75869238e4aa49b028bcf3b673751be3dffd847e36fbd7fb0c2244bf9a3a36ee0c01bbd2817ddd9b8b907e325c13ea201e1401708c84a632b6ea19fd4afee9
-
SSDEEP
49152:q4MK9f3aQ59L1rvGWmjytN+br8pyKeictxy5+FTH9hSL2:q4JJa0BgWkydpy7iexAo7CL2
Malware Config
Extracted
alienbot
http://baklavakaldam.co.vu
Extracted
alienbot
http://baklavakaldam.co.vu
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
com.squirrel.anchor1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD57a9f87a15b80a27f17293084c7595751
SHA17077e95adbeaba8969378751b19499a2c3f83203
SHA2567de089ecb955de190ffd5c8fafbe089e580f879a25f005602a9718a88bc13d26
SHA512b0ce98c3263779f5f99aca9d4c4b017cc35615364da6a5bc930b8426690188b1b7c81e3d35ea25628a15814ef48dbeee76a168a1af41f9bac5de46951ecf9e0d
-
Filesize
238KB
MD502d3345be639d5f079bb23b52ea98c88
SHA185a24d067bc3b082940f8f328845e4a02c0ea8be
SHA256c908241ca7e57988c0fcf66aa09a9fce4bfe931ade6fab20423ed72fbbc4aa4a
SHA512aed38e648c7c2b54774e578c46ad726e64d39c53d73998ebfae1b6d53d91af16bd458f0614155d9a8d5cc6ed219b9988049ed895341ef69db6268e9783904145
-
Filesize
482KB
MD5fd91e412b1974fac67f8f54378069b8c
SHA14b272db7ed3e2edf38a6031d9a75a8942770d98d
SHA25655479ff9383447fc43fd140ab8aaca82f3e92c9aa0bde7b0083690ee6cdd1b96
SHA512fba84ba7cc5b008e1f418b9477ae603db70ddc948d424a59ba44acce4b3e1bf84392c72aacac4f691621f6b207c19c6f567437cc48b7fe4be39c80149582172a