Analysis
-
max time kernel
2435892s -
max time network
161s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 08:36
General
-
Target
969178a180044391688e9a9b33a402af2d09b25c04126ff110ca9b90c36055c0.apk
-
Size
2.0MB
-
MD5
33a0329471bc89336a569b389d0c3f58
-
SHA1
2bb7d2bbdb97252d1d7df50d15677f6c2c1f0818
-
SHA256
969178a180044391688e9a9b33a402af2d09b25c04126ff110ca9b90c36055c0
-
SHA512
4e75869238e4aa49b028bcf3b673751be3dffd847e36fbd7fb0c2244bf9a3a36ee0c01bbd2817ddd9b8b907e325c13ea201e1401708c84a632b6ea19fd4afee9
-
SSDEEP
49152:q4MK9f3aQ59L1rvGWmjytN+br8pyKeictxy5+FTH9hSL2:q4JJa0BgWkydpy7iexAo7CL2
Malware Config
Extracted
alienbot
http://baklavakaldam.co.vu
Extracted
alienbot
http://baklavakaldam.co.vu
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.squirrel.anchor1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317B
MD5ef2f4049b392afd5f2d814c3a620f5a3
SHA162d002ce62a5878e4f8af0feaf60256b3c69e4e5
SHA2561c073d6eb5d6ec3b33a852ad08642e59d40efad8a3bc3d5627bf14eebf357457
SHA5125a1a798bd2a5ac68cb4a1b36d6ee683031cf71a59786d313bd67b3f37d2ce62db0d7bca47d667aaed3ae7b839dd46460cf1487061426d08e0c3ba165f3939cc3
-
Filesize
238KB
MD502d3345be639d5f079bb23b52ea98c88
SHA185a24d067bc3b082940f8f328845e4a02c0ea8be
SHA256c908241ca7e57988c0fcf66aa09a9fce4bfe931ade6fab20423ed72fbbc4aa4a
SHA512aed38e648c7c2b54774e578c46ad726e64d39c53d73998ebfae1b6d53d91af16bd458f0614155d9a8d5cc6ed219b9988049ed895341ef69db6268e9783904145
-
Filesize
238KB
MD50e3a318fcdccfaef79c5007aee8f6619
SHA1a4f9e7bad5c3be4f2d5c732bd04d7c54a653d85d
SHA2569d30c65873ac46544f9e94309b56d41a5b6a5bf1798f37d1ee6712b1c829a6ed
SHA512e801a11d72e88da7c4f4b1a31e511e8af69b2576fd5fddddc034e10ac440efa961a2aa1229934b8314fabb80c2974d756820ff079e629c069816f588568f1e85
-
Filesize
482KB
MD5fd91e412b1974fac67f8f54378069b8c
SHA14b272db7ed3e2edf38a6031d9a75a8942770d98d
SHA25655479ff9383447fc43fd140ab8aaca82f3e92c9aa0bde7b0083690ee6cdd1b96
SHA512fba84ba7cc5b008e1f418b9477ae603db70ddc948d424a59ba44acce4b3e1bf84392c72aacac4f691621f6b207c19c6f567437cc48b7fe4be39c80149582172a