Analysis
-
max time kernel
2511130s -
max time network
137s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 11:43
General
-
Target
ad221f6360f2202358a9603d377c0538349df1bb598d9dbca975cdb426d5f5de.apk
-
Size
1.7MB
-
MD5
dc074a4f513ff203176486e745594d11
-
SHA1
d238559c0faf5c0cb27c7897c8460c602bdda26f
-
SHA256
ad221f6360f2202358a9603d377c0538349df1bb598d9dbca975cdb426d5f5de
-
SHA512
c33dea43fa0fea4a9867fcea1b8d2de518046ee51dedeb24181bf73c375221b249d4cf1ad9bf9def84620f746fd6b1d9bd935285392bf88b5928a3c54c83e216
-
SSDEEP
24576:Tn2okVse+p3cuZ9nK/DZkCWG4fCScKj7a6ef2NgPONVMyxaMTLu9:TnK7uZ9KbZHrbKjfeuNi2MyxaMHu9
Malware Config
Extracted
alienbot
http://zesasar8.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
mnugzybkow.ziwsoipcmbnykcysrqp.tqdymtdpzrxawy1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
662KB
MD500ebde30d18f4c09321091c7860d09d9
SHA19de56e974cfa344016b3dcdc9eedac1e06c13c47
SHA2563f26f60368e910c4941bc389635ef37bca085f71ef0ea61922d40cc3ff2289e1
SHA51266e5429d4f4a455e3241637f6aac8a0d448e273eae230be851adbc1b79e25fe34f7863a32c48f85afab5ca021be673207a65e09e35e050fc88c9c07898067e2b
-
Filesize
662KB
MD54daf30e5f03f8f27e7d54404256ed037
SHA1041befe7d520245222d9355ad72b17de03ba1cf9
SHA25610a80145fa8d52379c049761be8f78f56553c016327bd6c7ce0fc3dbfa9a5803
SHA512e2265bc3d0517b4df298305bc8cc19556aa399afcbb1a50b7dbd6ac9240bbbd9986afd799b68eb4966010528b3e1797d3de5a778ef6435c965c6495faf2d125c
-
Filesize
324B
MD57a24982b35438243d22342e059ced22c
SHA10a95e103aeccb19277a3093aeaf6a4509d8e2012
SHA256e7f39b454d032b2457b94e8d7f87267bf6684b60072700a36e8f4554f88bc2f5
SHA512fa0537fd2af897f3f7d7b78d62641edcf9a7cf50f816a13c15a5aa228cca491199dd4e0ab8bc55211ae2e762d20e1d8b4d68acdecc5844a1ac74fe550e917b8b