Analysis
-
max time kernel
2462955s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 09:01
General
-
Target
9975519e1ae9ceffc6a7841b8c26fa356b98c0fd1e48df80bad49865066c28c7.apk
-
Size
2.3MB
-
MD5
1a3388bc2de001556f2ec1af473f8989
-
SHA1
d7d74bdef5b6ab2d4478cfec4e0181feb155ed45
-
SHA256
9975519e1ae9ceffc6a7841b8c26fa356b98c0fd1e48df80bad49865066c28c7
-
SHA512
419a9afdb95fa5764d0667a834e69f862eddb6301b74ec23986f688a72792fc7dc26187dff9edfc7ee791664362abbaa94196c4ed452f133623fcec8c1d50e38
-
SSDEEP
49152:cBa82ndZfnJsufx1sb0IXJPNlKg9bpHC7zVgaQWiuk8fNwUUOfT+gynKmCiam7A6:dXSYg+Ozg/UBHCLm7A6Zr
Malware Config
Extracted
alienbot
http://kucsas.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
idiherqibgwwakoxwy.tksptyldtghbfw.bnygioaufy1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
713KB
MD5df1e9509ced3c76f4e60f93e2fb37f81
SHA13f970cf2a514e7f668ae3645a41d80ead1922588
SHA25659da792f25dbde544145c489bce848eda9d4175701aec14f2f170cbbb2829ad7
SHA5124d6e8969ea2483558e7cd0a81d11a045750f0f7616f60fc87059ba910ccd532d0bcf8f750f43599d7e8c28f881257fddf9ff636cf35fcd021b0111114790bb9c
-
Filesize
713KB
MD510a784a4bf5028a5332c9abd5b25089e
SHA13fdbfb8baf4428fcb2dd5e126af0ba3d8c8538d4
SHA256cea01f1b9897a2f7290f0b06c21b3d966469c813c5d59cb109eec9c0b3770513
SHA5128d610beb95c1fd354a95c4ff6a0ed25c592d4bd79db38bc392c2b9aaefbf34b5f464b9a58d2fa6c83c704b9ef4891d4b7b6d7847dceb95f69d69dcb21989bfc4
-
Filesize
330B
MD5ba0fd846f6929ee30316c82afc566070
SHA109a960b12b92bb351bd92fc1975868709f9310b7
SHA256e9d68d65bf8ea98f62e6f24c8537e10c98dba220046e9e46dd2fbf5e131dc082
SHA512ed96315fac8205c867e819a9e03e2aee13516195d4b19214badfb5460365dc99d32f4dcdf4cdc7eba3da72cee52e1ca26e6816acea6ec7b993f2f11a3d34abc7