Analysis
-
max time kernel
2533597s -
max time network
95s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
23-12-2023 14:08
General
-
Target
76aae1533f1aca39631fe0a053338850966815e808332ce67ea3c0b4cd85a174.apk
-
Size
3.5MB
-
MD5
beeec17e265835b9dfc76f076664fdfd
-
SHA1
480d53259e0950af363236f289166edca189a742
-
SHA256
76aae1533f1aca39631fe0a053338850966815e808332ce67ea3c0b4cd85a174
-
SHA512
f10b45b2949cf98d45518cc5f82f88c13ea64388f179295ef63428c0764ad617347ad30f7d8f7248fff076f580c5f78aa63f42f807227ab05cbee68dc0ba489a
-
SSDEEP
49152:EUHKPS8aJluK5r1f0LRf7XMISsO0zjoK80obeW/9X16z2yrrH7MdBylHZIFW6B:6GP3bsf78Kzjo8SeWZwz2yLC106B
Malware Config
Extracted
alienbot
http://asayratermalhotel.xyz
Extracted
alienbot
http://asayratermalhotel.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
garlic.picnic.hungry1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
440B
MD5a9f76f4c63934524835da0a2fe07c8f3
SHA1a2585a571d1be0f8b0189b93c2ba17003c96fb55
SHA25653732e4dc26f13ccd137f8ead6bca688818d5fc6c028e57d23b0d88fd892d2ab
SHA512ea8317e11956152c224c62e95dfff2448f0864aecda984aa6b4bb6b33879caa2fbe97bdb618e15a6c0e33438d9334bbb8c9c3997d1f44ed49d757e4a446d25a2
-
Filesize
483KB
MD5a96ec73a6993ae5accddf47675ac5ca7
SHA163937376378c3fade65c3dd544bfc59d9a7850fd
SHA256772ca1b6b3231c91284f0e64187a47315ff5a3b81decac76600dd30b3b303e4b
SHA51277eac3a89d4985c11286c3d46fa60d057eca907c0bbfe23291aa67c671fb0b023572768152ebadc7c7a97fca93eb1a8674a737ef405d77f2fbb6acdf49dcc7d6
-
Filesize
483KB
MD57f9182268a63ef30c1ccca408a37ace8
SHA171d54110c93e7cc9038376dd0a0b6267d58577b2
SHA2569872e545d5d52bbe812541012ec6b22696850c3d15d8827ec73f18708ae1b03e
SHA512400bb73b828dd9f745fbd5f03770e6fb3db8466083477879f8da8c96e5aecd8b306654ee82d879de8a1b36b755c965fdf66942a9753b90e79a5977aa4adf09f9