Analysis
-
max time kernel
2440127s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 08:47
General
-
Target
97c3cc1c42fb7427256c5d7938d3e8f21fd98cce8d327adf10244291d3c68ee9.apk
-
Size
1.8MB
-
MD5
c35aeeab03a3002deb83aa86ec863622
-
SHA1
29ab2b28845cb48c55ecaeefcbdd42c1a0878e79
-
SHA256
97c3cc1c42fb7427256c5d7938d3e8f21fd98cce8d327adf10244291d3c68ee9
-
SHA512
f947a8c3fa068577162dcb85d0051cdeca4915e28197b2d91dd7c52e078ed43e1ec013554eab87cec588a1faf9c9fb2175ac792a6a664601e0ca614a438eb092
-
SSDEEP
49152:WqUfQvw2s77wdBqu0bVvYGrcfQub28Qz2pw:CfQdK8QvYGYfQuq8QZ
Malware Config
Extracted
alienbot
http://zeus45-3.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
wwbthkwyq.ubeefrquxp.aecrjqdaz1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
630KB
MD5bf4bbc648581b3799242cf186382777a
SHA1d6587f4e863620edd7bb997bfc5ea616c9177e35
SHA256892091b9491a52ba7d4c6c6fe6adb68e39e1e4fb48da689108bdb5353de22613
SHA5126e51bc425e577ffaaa976f0cc3ef430244481200a37c6bca09fa7fb33e9802ed07a3d18ac49c50cfb033e19fd9d8668d32fccede3a3901e5fd32788f569b6929
-
Filesize
630KB
MD59270824c8c898e998b3a7a21d9760bd1
SHA17b9e31c82a745f2cf55fad5edd69d1c73f69564e
SHA256e7528f5c91259b0244e6585aa4f9dcdec2324ea99fdda45eeef72954d8b3bea6
SHA512b5be04cde6e15aa4787bb822aa28dbc2ce68d021e81e387e4ff2700cb2f5b9399117728281de2ae9690011526f1dd19ab59fc4f58e29012d50d46c263c051ee9
-
Filesize
372B
MD5731b5f6cf8a2c2f8758611c5fbabdff8
SHA1b8b067873dcd1ebd3c1af8eaf2681791ce6f5a14
SHA2562b692868950dec40ebce0d50505d30b41cf06fe29c8c9d331f92bbcf6fe3073f
SHA512d97459a06e5f20b5483332a511dcf6e8b6c212b27db083cef2c55ffafa033b5cb55c53a9be03f34f5134e20b058f7ca8d25e3130b45900ac77b6fdf93f8c3aca