Analysis
-
max time kernel
3355198s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
30-12-2023 10:20
General
-
Target
15b4ef12a281c43662138a9bb37d9456.apk
-
Size
3.2MB
-
MD5
15b4ef12a281c43662138a9bb37d9456
-
SHA1
1a9fbb759957025602457517995baf73ab615142
-
SHA256
b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6
-
SHA512
a6750924d92ac92073bff32346d1cf5ba9a3908786fc73f4bbddd16c131abe2cbca05d53d9d14c69389e0e2822d542e324c3aaf6ab507d94b626aed7f768b3e4
-
SSDEEP
49152:zfNfFh0ky8itaHUrnKvVBxQhozddqwhDjbjxxlVWC8K2maOqvyYSKTEj3vO7VXjh:B0FnLupF1jbjxxldsaYSKwjii5gl
Malware Config
Extracted
alienbot
http://34.89.218.199
Extracted
alienbot
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
already.lamp.alien1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
682KB
MD55239c6a4692eeae51389728966857f5c
SHA1d298d033d52b0a682b305caff7c609f205ee16c0
SHA256567a7aa54a983ffe16ee124b200bf0f931df1c53183857d98c12657da52aac7d
SHA512831746b8bf0c57e2d52cf34febb04dfe5de8386326c9443d3f09e734c4014a5098a98f39071c60633ccc26819c6022f81663dab10843ed9744d44d6385ecb623
-
Filesize
682KB
MD5c0eabeca18fe2be9fed618a7fb3729c1
SHA1961b9deaa028c482415fa731e8478800233c639e
SHA25617f59a7b3df98d0f95f799cea2a9443fe7ac1aa2d42672dca62e4f7675dcc2b0
SHA5123732570521cf40e927a0a45d3257818a4cfadc3d2a9c103bbb5505c2578af30c6f4bebdcb56ee06698693b525c099faf92bf5d92c8202ec9d61ace96817399ae
-
Filesize
437B
MD56aa404a8454a39448d4fb4e3463faed4
SHA1da380054d8e9098b10e9e575f82743ce550f1f4b
SHA256e4fc109b17692c5f20198e83b1d2ba4fd35f85568cff8783fd50292b8357d70f
SHA512484f9935b23fb47afdc7fb07b8d71e9bef68421d27414825ed4d4edf8e0fc7f56723cf3047e2445473445cea2418fe989a32127b0837dc57e15ecf264852baf3