Analysis
-
max time kernel
3102427s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
29-12-2023 21:03
General
-
Target
03f03027f6d1f021e845b23cf3a15aea.apk
-
Size
3.2MB
-
MD5
03f03027f6d1f021e845b23cf3a15aea
-
SHA1
76d1fe6ca6ef8bb7f03574c60ec5259c9dfd6bf6
-
SHA256
7e914e4c0769a7a1dcf7d3a06160bfbd9f7b583695ccc9282854c2946b0321db
-
SHA512
ba02a72c684203191cc5521d5405c7077739c16a82cb1e1f52dff3ad5bd85d7d62e3bbd156eca02ac81aa89c1ad3dd9167e8994adb0e3f51db3d55c71d0b0ca3
-
SSDEEP
98304:u8u3g1G0eluSakIJ27zhQQCiJawwTosko1m:03WG0elJaXyz3CBvVko1m
Malware Config
Extracted
alienbot
http://34.89.218.199
Extracted
alienbot
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 7 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
tissue.crash.potato1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701KB
MD5552d1b1b1f93f817fb65326dfd722264
SHA11b12cd4dc032e29cd75bc7144732225b33b455a2
SHA2563f855468956b1837dba9be64bb44d8870b83bb50f7e7ec8125179a9e08412a93
SHA5129d9848cda1e5bd0d8c78bdeaa3df30b210848d979d9bd6a81203f0e8080d4f9cfa43c5631b48b3769616882da5d62b451471cd9fd835a3bf15ff3cfa11f1159a
-
Filesize
701KB
MD5b08a9bdaec148afbe0428fdd8327f0f1
SHA1e69758c1facb618dad896fe1e8e91f281bb3ba80
SHA256cf49cf816453fb5791fc886cea1f8ec28354403987846c3c3b17068dfd619a57
SHA512b764ebf887eec11dc1cc9883c523bf7ee4d1107555ab08cf20c5b11c55a21c766cc6faa46060e4f1d03c670c9e49d4477e2699b408e37240c708a4043635a77a
-
Filesize
359B
MD5c6ce8c6d883773ce165fd031aadb2772
SHA15747de0002b98e34541ba3df604131f85c2d4ddd
SHA2561c4110796aed30b4c2e2a37c91e948d6318e843dc726530769c33f34bd951f07
SHA512076f5bf478c2a7e955fc59f840a33e477d4162498519701d35fc9fdc8463070435d833b19af98e6c57dbf1c86b578db47481285f4d65c6adaecafb792eba7851