Overview

overview

10

Static

static

6

15b4ef12a2...56.apk

android-9-x86

10

15b4ef12a2...56.apk

android-10-x64

10

15b4ef12a2...56.apk

android-11-x64

10

Analysis

  • max time kernel
    3355231s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231215-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
  • submitted
    30-12-2023 10:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15b4ef12a281c43662138a9bb37d9456.apk

  • Size

    3.2MB

  • MD5

    15b4ef12a281c43662138a9bb37d9456

  • SHA1

    1a9fbb759957025602457517995baf73ab615142

  • SHA256

    b77decb8c8407f3081f009624795035f912dd842224acb55b437dde937a338e6

  • SHA512

    a6750924d92ac92073bff32346d1cf5ba9a3908786fc73f4bbddd16c131abe2cbca05d53d9d14c69389e0e2822d542e324c3aaf6ab507d94b626aed7f768b3e4

  • SSDEEP

    49152:zfNfFh0ky8itaHUrnKvVBxQhozddqwhDjbjxxlVWC8K2maOqvyYSKTEj3vO7VXjh:B0FnLupF1jbjxxldsaYSKwjii5gl

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://34.89.218.199

rc4.plain

Extracted

Family

alienbot

C2

http://34.89.218.199

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 8 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • already.lamp.alien
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json
    Filesize

    682KB

    MD5

    5239c6a4692eeae51389728966857f5c

    SHA1

    d298d033d52b0a682b305caff7c609f205ee16c0

    SHA256

    567a7aa54a983ffe16ee124b200bf0f931df1c53183857d98c12657da52aac7d

    SHA512

    831746b8bf0c57e2d52cf34febb04dfe5de8386326c9443d3f09e734c4014a5098a98f39071c60633ccc26819c6022f81663dab10843ed9744d44d6385ecb623

    Download Submit

  • /data/user/0/already.lamp.alien/app_DynamicOptDex/KFxDOYB.json
    Filesize

    682KB

    MD5

    c0eabeca18fe2be9fed618a7fb3729c1

    SHA1

    961b9deaa028c482415fa731e8478800233c639e

    SHA256

    17f59a7b3df98d0f95f799cea2a9443fe7ac1aa2d42672dca62e4f7675dcc2b0

    SHA512

    3732570521cf40e927a0a45d3257818a4cfadc3d2a9c103bbb5505c2578af30c6f4bebdcb56ee06698693b525c099faf92bf5d92c8202ec9d61ace96817399ae

    Download Submit

  • /data/user/0/already.lamp.alien/app_DynamicOptDex/oat/KFxDOYB.json.cur.prof
    Filesize

    378B

    MD5

    e3dfd68cacff55eb0a58d7f21072ecb9

    SHA1

    65e13055cc4e8aa70a3494c18b89059471cd834e

    SHA256

    c2b95ff843e70ddda3af4995602fb8a345bba20b11fd8e2a2b2a62aeed40319b

    SHA512

    8c30ad90f5cc423065c58c2048568127c8a697a40e872e901e70073aa606a418f4f792f10ede0653229e0d5c2c1d27d6cbd8e14019f2e2d6e5ca975718a5bd76

    Download Submit