Overview

overview

10

Static

static

6

15b4ef12a2...56.apk

android-9-x86

10

15b4ef12a2...56.apk

android-10-x64

10

15b4ef12a2...56.apk

android-11-x64

10

Analysis

  • max time kernel
    3355197s
  • max time network
    150s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    30-12-2023 10:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15b4ef12a281c43662138a9bb37d9456.apk

  • Size

    3.2MB

  • MD5

    15b4ef12a281c43662138a9bb37d9456

  • SHA1

    1a9fbb759957025602457517995baf73ab615142

  • SHA256

    b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6

  • SHA512

    a6750924d92ac92073bff32346d1cf5ba9a3908786fc73f4bbddd16c131abe2cbca05d53d9d14c69389e0e2822d542e324c3aaf6ab507d94b626aed7f768b3e4

  • SSDEEP

    49152:zfNfFh0ky8itaHUrnKvVBxQhozddqwhDjbjxxlVWC8K2maOqvyYSKTEj3vO7VXjh:B0FnLupF1jbjxxldsaYSKwjii5gl

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

rc4.plain

Extracted

Family

alienbot

C2

http://34.89.218.199

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • already.lamp.alien
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4249
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/already.lamp.alien/app_DynamicOptDex/oat/x86/KFxDOYB.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4277

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json
    Filesize

    682KB

    MD5

    5239c6a4692eeae51389728966857f5c

    SHA1

    d298d033d52b0a682b305caff7c609f205ee16c0

    SHA256

    567a7aa54a983ffe16ee124b200bf0f931df1c53183857d98c12657da52aac7d

    SHA512

    831746b8bf0c57e2d52cf34febb04dfe5de8386326c9443d3f09e734c4014a5098a98f39071c60633ccc26819c6022f81663dab10843ed9744d44d6385ecb623

    Download Submit

  • /data/data/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json
    Filesize

    682KB

    MD5

    c0eabeca18fe2be9fed618a7fb3729c1

    SHA1

    961b9deaa028c482415fa731e8478800233c639e

    SHA256

    17f59a7b3df98d0f95f799cea2a9443fe7ac1aa2d42672dca62e4f7675dcc2b0

    SHA512

    3732570521cf40e927a0a45d3257818a4cfadc3d2a9c103bbb5505c2578af30c6f4bebdcb56ee06698693b525c099faf92bf5d92c8202ec9d61ace96817399ae

    Download Submit

  • /data/data/already.lamp.alien/app_DynamicOptDex/oat/KFxDOYB.json.cur.prof
    Filesize

    536B

    MD5

    e9ccbfd8f741f1ea10f67be46f29a4a9

    SHA1

    36654a020e499cf713eb175c408c2d82dae72931

    SHA256

    5ca52d45be71c01ff2365b4b8f2c2dc87c0d80ca391eb92a7cf15834c0f669c2

    SHA512

    20d72003f9d721e2d8544a2d34fafaaad6c045aa67ccafd7aca617986977389f3792543f0810c8df808879a5e55e40d1392318293938ffbeecfd95b219b36a30

    Download Submit

  • /data/user/0/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json
    Filesize

    682KB

    MD5

    f111f1cf378fd9addbd3c86e869a1a85

    SHA1

    131dfebcf97d9808dc7f1b681fb9d772bace2df5

    SHA256

    5fd54511629954a6c022cb4309740e17c176be9df983a2bae45eda6e325ae57e

    SHA512

    30b54b94671149d300454ed8d09081376550a31de302385d1f0c0961e70160469fd085452a6600d6ca53d86ae48d40be99eea955a511f27b2f4992c37753bce7

    Download Submit