Analysis
-
max time kernel
3539899s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
30-12-2023 20:39
General
-
Target
1bffaf984e5c68613b2da3fdfa1244ce.apk
-
Size
1.5MB
-
MD5
1bffaf984e5c68613b2da3fdfa1244ce
-
SHA1
5e4abe059e7b55c4a77e2ea0d79aecaa4e4aed1b
-
SHA256
e981e67f3931a9c945e02f233ddfa7e3531ed7c58e670465ef390809c46b81da
-
SHA512
fafba366394e809e5453098fb34998ac351d4893870889b0a39fed3d5c96e268d301f7a4501f04ed063a955075fdf253188958896599a42c3035dd0c4c53b464
-
SSDEEP
24576:HDzrdq4KdLZMa4XnvMNoilSrzGiPy48em6+cWz13bh6:zdq40tVMMNoicHGiZPdWh3c
Malware Config
Extracted
alienbot
http://optimpres.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 7 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
ogumydadjhgfl.nxfwaskmujfjbj.wxrzgguabtsdtqyx1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
389B
MD5d5d2caed24f3d1ff161b0d9cb78fd5c3
SHA10879d8c5fa02b18fdee3cfb1e90c4a2b067e487f
SHA256526a864db9d039a29bd69fcbc5ff645fec8e4cc129fded1d1f215431c2d6c028
SHA512b392d94b03f779fc8e0bf3810214bd806dc30ce6378b555efa6657137eef447b556d837fd82fb0af45f0574c3a15d3afb01e720f72e34891297334cc4d011e90
-
Filesize
650KB
MD53c0ffc5409b96991c5f8fbea443f1876
SHA13727e166c901d698555e8756c6a7e3979fe51b6f
SHA25656819060973fe8300696b58d33511a02c163eac7bf6a531ea4a1bb268fd6f5bd
SHA512d83495b137f4880ce38f0f2e843d441ed4d89af88b7c4c6ca092aea10c72047e4628ed39be1532c16682b92428fd66580388605d7ebf7cc18672076fdbb3e497