Analysis
-
max time kernel
2499126s -
max time network
136s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 10:33
General
-
Target
a44b03ea43c561095e1d0c6385ba00d86e02ee8ad33c0dac1d6b9d5f073ae9cb.apk
-
Size
2.0MB
-
MD5
d4fd334971337b0296ec3141c80499b0
-
SHA1
4bac68cba4c1a2744f3a0d1505f287bb13f75e71
-
SHA256
a44b03ea43c561095e1d0c6385ba00d86e02ee8ad33c0dac1d6b9d5f073ae9cb
-
SHA512
654edeccd100c0c89619d2f262ec9eb780ece5c7e80074e16fff0876c5a3307cbd9a3f04fd4af8556608ba823fc3efe52966dc07c8f5e82619381de91c791cc2
-
SSDEEP
49152:KGEV1bc9inXRz0F8JFG5gvuFhEJUT9jT46sZmOz:pA1g9iX10czvuFyJUTZT46sZmOz
Malware Config
Extracted
alienbot
http://dreambufadfuxla.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 5 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
cgiritcdrcrlgexjqzundrw.rmrzmqycqjiaagb.xmpuqzpefasgunqucqaphmdoasq1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
663KB
MD5840776009386597ed595a2e54db83cf4
SHA113636149ed38a11d7131e009b75c6f5dd8256865
SHA256f702f7a7eec6aa74e660ceb99a337f923337d5c08d2915c71d9365ee84506f56
SHA512a576eae97c358783465a9434833485b4e73188e9a309606e80fd89ce8c3ebc0d6e05f33afef11642b1924acd3c9ce796f0539c63cf25df6920c2ff48972fbd11
-
Filesize
663KB
MD5a5b4a0e001486ffbfb098ad41b42aca8
SHA1c14748fcc292923e46f460e1aa0fc61056f7535f
SHA2563e8a1200bf40f1b349d9ba37a0079546f76df09a93a6957446b397bac443f98b
SHA5121ea8824625a457ccec2eccf9b17781a71c582a05634793ae6eae2d8b4dc08ab74e151a1028c0b9742c6dd94abee76cb1edefffceede73d408ca241aa738a9a9b