Analysis
-
max time kernel
2533612s -
max time network
81s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
23-12-2023 14:08
General
-
Target
76aae1533f1aca39631fe0a053338850966815e808332ce67ea3c0b4cd85a174.apk
-
Size
3.5MB
-
MD5
beeec17e265835b9dfc76f076664fdfd
-
SHA1
480d53259e0950af363236f289166edca189a742
-
SHA256
76aae1533f1aca39631fe0a053338850966815e808332ce67ea3c0b4cd85a174
-
SHA512
f10b45b2949cf98d45518cc5f82f88c13ea64388f179295ef63428c0764ad617347ad30f7d8f7248fff076f580c5f78aa63f42f807227ab05cbee68dc0ba489a
-
SSDEEP
49152:EUHKPS8aJluK5r1f0LRf7XMISsO0zjoK80obeW/9X16z2yrrH7MdBylHZIFW6B:6GP3bsf78Kzjo8SeWZwz2yLC106B
Malware Config
Extracted
alienbot
http://asayratermalhotel.xyz
Extracted
alienbot
http://asayratermalhotel.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 6 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
garlic.picnic.hungry1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329B
MD59713490fe3a99c09b121f2ec2f0155f1
SHA11ccfde193d1252618c53ffc761dd644faa6fb3ff
SHA2563b6c39aae6f9c06acdce0e341c733ca3accfa3b7dfa9bca8d1a8a60f9c382348
SHA51200225a92338904ce5402fa906caba9d4ce6b9e8fba4a7b8fa1b1298a64d6d45b0366306e6e10b3d9d06c8a897ef1f8f54482126aade6fa584f046230fff2ff9a
-
Filesize
483KB
MD5a96ec73a6993ae5accddf47675ac5ca7
SHA163937376378c3fade65c3dd544bfc59d9a7850fd
SHA256772ca1b6b3231c91284f0e64187a47315ff5a3b81decac76600dd30b3b303e4b
SHA51277eac3a89d4985c11286c3d46fa60d057eca907c0bbfe23291aa67c671fb0b023572768152ebadc7c7a97fca93eb1a8674a737ef405d77f2fbb6acdf49dcc7d6
-
Filesize
483KB
MD57f9182268a63ef30c1ccca408a37ace8
SHA171d54110c93e7cc9038376dd0a0b6267d58577b2
SHA2569872e545d5d52bbe812541012ec6b22696850c3d15d8827ec73f18708ae1b03e
SHA512400bb73b828dd9f745fbd5f03770e6fb3db8466083477879f8da8c96e5aecd8b306654ee82d879de8a1b36b755c965fdf66942a9753b90e79a5977aa4adf09f9