Analysis
-
max time kernel
3355231s -
max time network
166s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
30-12-2023 10:20
Static task
static1
Behavioral task
behavioral1
Sample
15b4ef12a281c43662138a9bb37d9456.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
15b4ef12a281c43662138a9bb37d9456.apk
Resource
android-x64-20231215-en
General
-
Target
15b4ef12a281c43662138a9bb37d9456.apk
-
Size
3.2MB
-
MD5
15b4ef12a281c43662138a9bb37d9456
-
SHA1
1a9fbb759957025602457517995baf73ab615142
-
SHA256
b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6
-
SHA512
a6750924d92ac92073bff32346d1cf5ba9a3908786fc73f4bbddd16c131abe2cbca05d53d9d14c69389e0e2822d542e324c3aaf6ab507d94b626aed7f768b3e4
-
SSDEEP
49152:zfNfFh0ky8itaHUrnKvVBxQhozddqwhDjbjxxlVWC8K2maOqvyYSKTEj3vO7VXjh:B0FnLupF1jbjxxldsaYSKwjii5gl
Malware Config
Extracted
alienbot
http://34.89.218.199
Extracted
alienbot
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload 1 IoCs
resource yara_rule behavioral3/files/fstream-2.dat family_cerberus -
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId already.lamp.alien Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId already.lamp.alien -
pid Process 4620 already.lamp.alien 4620 already.lamp.alien 4620 already.lamp.alien 4620 already.lamp.alien 4620 already.lamp.alien 4620 already.lamp.alien 4620 already.lamp.alien 4620 already.lamp.alien -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json 4620 already.lamp.alien /data/user/0/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json 4620 already.lamp.alien -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock already.lamp.alien -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS already.lamp.alien
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
682KB
MD55239c6a4692eeae51389728966857f5c
SHA1d298d033d52b0a682b305caff7c609f205ee16c0
SHA256567a7aa54a983ffe16ee124b200bf0f931df1c53183857d98c12657da52aac7d
SHA512831746b8bf0c57e2d52cf34febb04dfe5de8386326c9443d3f09e734c4014a5098a98f39071c60633ccc26819c6022f81663dab10843ed9744d44d6385ecb623
-
Filesize
682KB
MD5c0eabeca18fe2be9fed618a7fb3729c1
SHA1961b9deaa028c482415fa731e8478800233c639e
SHA25617f59a7b3df98d0f95f799cea2a9443fe7ac1aa2d42672dca62e4f7675dcc2b0
SHA5123732570521cf40e927a0a45d3257818a4cfadc3d2a9c103bbb5505c2578af30c6f4bebdcb56ee06698693b525c099faf92bf5d92c8202ec9d61ace96817399ae
-
Filesize
378B
MD5e3dfd68cacff55eb0a58d7f21072ecb9
SHA165e13055cc4e8aa70a3494c18b89059471cd834e
SHA256c2b95ff843e70ddda3af4995602fb8a345bba20b11fd8e2a2b2a62aeed40319b
SHA5128c30ad90f5cc423065c58c2048568127c8a697a40e872e901e70073aa606a418f4f792f10ede0653229e0d5c2c1d27d6cbd8e14019f2e2d6e5ca975718a5bd76