Analysis
-
max time kernel
2484097s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 09:50
General
-
Target
9ecfdb3f359362d2bc6d8a4fcc9b05e57e085d0828853dbdff80c8af3ec3dda6.apk
-
Size
1.7MB
-
MD5
32d7d89f341e89b7bb59834656f9e4c9
-
SHA1
c51529dacc5ae25f26dfa84d0fff08a3f5482aa7
-
SHA256
9ecfdb3f359362d2bc6d8a4fcc9b05e57e085d0828853dbdff80c8af3ec3dda6
-
SHA512
9f84c6f11ca0e0677c41eb2a823dcbfb6a816076720d7ae614a21308f2835c7d7a8e389bdf95614acf6569f0646ef8877915711dbaa3769492ad186ec993b5eb
-
SSDEEP
49152:YWBOYv/sgCEmL6/IL+nf9EZubenAp0aWb1gtAof+s62T:N/sVL6/ILq2yWApyJgtAofHzT
Malware Config
Extracted
alienbot
http://cacecarsa3.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 7 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
bdooloiiwcmokslt.bpwkbcjwgyqxywilcggecj.qolrxjcoqwaqyhjdbzpcwkewzxw1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
708KB
MD5183b74893257b6ff8b58b8079a4cae71
SHA179b049bb781d4bb3875c740a0157c9de089675f0
SHA256d3d4639317e52154170ce1be2ec207b8b3d0aa92748e54ea23844bf8328cb287
SHA512e95e58bb544b48281e0508445d21b3173b7abb51fb6aea30a7ee827b9814deb87a3c5d1e691a9c070f092dc56d65906bccb3c9ac1500d0cc955ab67b81dbb976
-
Filesize
708KB
MD55b831627488bf1bc64453c395bd5ee74
SHA1851f75eb2236220f613733b30cbe90de5095f9cf
SHA256a0c008f5502b0a4d829f954c197e95e3c20fdc52f2863768da0f7a4bcbca693a
SHA512cacc3f9581144a6e1a5db0ed2a87d4741611dd913a08021aeb8506a4af1d90c9b2dded8f2fbed5bdfbdbe14eaf4a0980b0c890c46182781e25f0f1b36bd08d44
-
Filesize
320B
MD54ac7d1667f3dd694a34eed17c61623d3
SHA1ab03c4590c644d17737f7c2bf69850561d13ca3d
SHA256cb3eea5233f6fc8ce5747f093d048f6170a9ca7d7a3b66fe5ab288c07d4affbb
SHA512e606fc0fc5b9115a96a70f58bf9835b80ebee72a5f29b69b1b9c15ed0fd94e9d18192539847ee9e62fcb9038fd68cc63bf5df9df884b96fe2ecf8746b9838f44