Analysis
-
max time kernel
3539896s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
30-12-2023 20:39
General
-
Target
1bffaf984e5c68613b2da3fdfa1244ce.apk
-
Size
1.5MB
-
MD5
1bffaf984e5c68613b2da3fdfa1244ce
-
SHA1
5e4abe059e7b55c4a77e2ea0d79aecaa4e4aed1b
-
SHA256
e981e67f3931a9c945e02f233ddfa7e3531ed7c58e670465ef390809c46b81da
-
SHA512
fafba366394e809e5453098fb34998ac351d4893870889b0a39fed3d5c96e268d301f7a4501f04ed063a955075fdf253188958896599a42c3035dd0c4c53b464
-
SSDEEP
24576:HDzrdq4KdLZMa4XnvMNoilSrzGiPy48em6+cWz13bh6:zdq40tVMMNoicHGiZPdWh3c
Malware Config
Extracted
alienbot
http://optimpres.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
ogumydadjhgfl.nxfwaskmujfjbj.wxrzgguabtsdtqyx1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
650KB
MD5b3f4caec5c7ac55185a0971a0db3b792
SHA141a4dee66538a33ab77e2ee893cdc209ff92a320
SHA256a74eceff67adeeb4b6dd2c27bb10a2f4ea3ae9021045b40c8342278739442077
SHA512598a8b0dfc64b44618fc92bd570b759ff8e32097055f291fb0c81c8d2e7a12aa01e56a58237b8c37124a2f26811c8fbe4b4a266242850b9800e014f453cfeac5
-
Filesize
650KB
MD53c0ffc5409b96991c5f8fbea443f1876
SHA13727e166c901d698555e8756c6a7e3979fe51b6f
SHA25656819060973fe8300696b58d33511a02c163eac7bf6a531ea4a1bb268fd6f5bd
SHA512d83495b137f4880ce38f0f2e843d441ed4d89af88b7c4c6ca092aea10c72047e4628ed39be1532c16682b92428fd66580388605d7ebf7cc18672076fdbb3e497
-
Filesize
333B
MD5b90bb35bbc7d26345b39bd2dedce9646
SHA140926a630f1a0f36171073f46cad205fe5bd066c
SHA256d3a10b1a93a5eafac638238a446d254be413742073ca6691da00ff803df5e21c
SHA5126d7ea0167ca880eda56fae792315d359721e93713af84f5d54030289a8733ebb6b9849d2ff9d46816b6934433167edc39bab5f3a35858397bdf34bc8a6c912f8