Analysis
-
max time kernel
2785793s -
max time network
155s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
24-12-2023 06:02
General
-
Target
e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c.apk
-
Size
4.1MB
-
MD5
c964e7894329592360aff35b7b23205e
-
SHA1
cfecbbb47621aae31c38dd3627731362faf1638b
-
SHA256
e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c
-
SHA512
439c8bc169dac94fedb73c2e8c77c09d6cd0848765ec6ebe41fb49464ce6b48c1c3dee7c925da34c2b91a39604b0365eddba8fe60cf5946c0bd7128e51f30bf0
-
SSDEEP
98304:GVPE9wlCb8u8aYe/l5awpIK9bRjrimV9uCQeNGxmhdLp:GVPE9WCbx8azlsm1cs9UeNjdl
Malware Config
Extracted
alienbot
http://vaydemenescomeres.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
damage.found.shrug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329B
MD53739a5618eebb1db32e85f4ad9a43f50
SHA13bbc7ab4c641ab6ef472f1e191978e8050dbc01c
SHA256261f215127fe775d470bba53cd8107aae5ed76a268ec1140502ebc15dfaf458d
SHA512eb30ca74e55b7ba5b324b778929f3486ca32dd917b24ef820457e2604c5349481d0625f19b4db7d4b2a7cd30ddb7cf7b221d811555ab63dcaa1dd41efa1b48b7
-
Filesize
682KB
MD55f8a4837f4def1b09b0f188673123d22
SHA11e3920332d14db0c60f8e86c9351505d4a1331e0
SHA256dbf46ae64f71b721f836f9c226449b40668031971524f1fc3120794c9fc2e67e
SHA51200394441aeb7109d38d67b26920d5931c17a5f19fcc9e56a5c016bce5c8d753c7b713b92774c09d676e2f1f24e1ef0bf7275a768178a5b2be69bc82b0debf52e
-
Filesize
682KB
MD5d0cc1d856bc60542ac6bbd8b52f219ba
SHA142e30dadf7bbb78e547e412278b51f8803a039e6
SHA25615c592305a47f5711e95708cd693b06ad287e2bb554a1ea27035aadba26af0db
SHA512bf7398b9fd56f374959b26a9f3aece8c951839f159ea92cd244cefbf064dce3bd722777697d87f55da6e2c703289a30cc8b6f2e90432af207c10829ab91f53bd