Analysis
-
max time kernel
2511531s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 11:02
General
-
Target
a7dbb5996bd9b02bebec53c976d62a610c213fe39b79a744140fb5d2bcd9136a.apk
-
Size
1.8MB
-
MD5
8e25e46e69ed8c25c7fd60b830c5a574
-
SHA1
882c7a30538673f6192e35bb47f56c92e663b2b2
-
SHA256
a7dbb5996bd9b02bebec53c976d62a610c213fe39b79a744140fb5d2bcd9136a
-
SHA512
3058fc82e3ce4aa6e99b81d06b328f524db6b1fe9202ae76535750103ee2964801e085c1227659004c74ef56403c4949db9c2468362ec3383832e6b20d20fe67
-
SSDEEP
24576:3vD8EpwM9WBOe9pzNuREJPaFTHcN2UvbWbt4A+D97aRjI9P8w1edaK/lUs+VDjmL:FWBOkvw2eTVUvbhela+GZjzN+X
Malware Config
Extracted
alienbot
http://cacecarsa6.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
znccflrfox.kkmokobioygmrwhnlfbxhecfbk.dnywfoafgbjnoqhshgj1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD5f0b62f2f07be3e9807e17044900a1db7
SHA1c75764bc8736dfc9639cadd0a58bd2f13d105e27
SHA256052bed872fc6956018e4d248ea60c0ec5d5a55c5c6ce382d562873f6ba8d8eda
SHA51285aaa488a1d853835d674f631bf94344a30ad5adaddc2f6548efa2093c38d2b39b7e89bfd48321897872d176ba938337ef9363db7d5796d0ef0cde6d6e6df132
-
Filesize
690KB
MD5a5888e5f5a95843473431644f43da651
SHA125f2e51a6ce0a10ec86f7587d469eb460187212e
SHA256ca969bd6bfb088e91c57ad6d230f1cdb8f9e781882f660ad34dc3e3dc168f8c5
SHA5120919244d33eb986a86113e1764910b1b61444738452d3d10eec03d7b9916c227c6f784a5e804fec650be2b10b4fa7ce45ebde4af839e83076dd0fcb47b264181
-
Filesize
314B
MD510dbd35fbbb7fc7f7c893a2ff781a536
SHA1111cfe8816ee014a76ba8e24764622bd761d159d
SHA25645da5742f9f499c2586eb48005dc2572c9cfc44413227e78056e1cee3e8f232b
SHA512608ce11ec88c40ea1e1446d911d2682e0d6d1b4b23cdda970283d8d810a278f0b090cbe78ca1ec19fe13fcf7f5c4459a72160e0f7d290451e5a671cf4e6fa2a8