Analysis
-
max time kernel
3102414s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
29-12-2023 21:03
General
-
Target
03f03027f6d1f021e845b23cf3a15aea.apk
-
Size
3.2MB
-
MD5
03f03027f6d1f021e845b23cf3a15aea
-
SHA1
76d1fe6ca6ef8bb7f03574c60ec5259c9dfd6bf6
-
SHA256
7e914e4c0769a7a1dcf7d3a06160bfbd9f7b583695ccc9282854c2946b0321db
-
SHA512
ba02a72c684203191cc5521d5405c7077739c16a82cb1e1f52dff3ad5bd85d7d62e3bbd156eca02ac81aa89c1ad3dd9167e8994adb0e3f51db3d55c71d0b0ca3
-
SSDEEP
98304:u8u3g1G0eluSakIJ27zhQQCiJawwTosko1m:03WG0elJaXyz3CBvVko1m
Malware Config
Extracted
alienbot
http://34.89.218.199
Extracted
alienbot
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
tissue.crash.potato1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701KB
MD5552d1b1b1f93f817fb65326dfd722264
SHA11b12cd4dc032e29cd75bc7144732225b33b455a2
SHA2563f855468956b1837dba9be64bb44d8870b83bb50f7e7ec8125179a9e08412a93
SHA5129d9848cda1e5bd0d8c78bdeaa3df30b210848d979d9bd6a81203f0e8080d4f9cfa43c5631b48b3769616882da5d62b451471cd9fd835a3bf15ff3cfa11f1159a
-
Filesize
701KB
MD5b08a9bdaec148afbe0428fdd8327f0f1
SHA1e69758c1facb618dad896fe1e8e91f281bb3ba80
SHA256cf49cf816453fb5791fc886cea1f8ec28354403987846c3c3b17068dfd619a57
SHA512b764ebf887eec11dc1cc9883c523bf7ee4d1107555ab08cf20c5b11c55a21c766cc6faa46060e4f1d03c670c9e49d4477e2699b408e37240c708a4043635a77a
-
Filesize
486B
MD5edfafe939b94764947c9d47ed2222110
SHA1973292f666bdea47249c33c352d37a730def00ea
SHA25603828c526848828de797ba2a3c60f4ed5a16d8091377f2ceeeace8ffecbeaf27
SHA5125d192c390a6e42e7fc36f4a186e114bf094df9e87ebc543b761e861aecc328c7b1a15654eec1ac389f93e874c3002d942ba5de73f23f5aec3d960b8cf372fbef