Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3624907s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
31/12/2023, 02:35 UTC
Static task
static1
Behavioral task
behavioral1
Sample
24b12a6b58a37dfa57a7563883efabea.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
24b12a6b58a37dfa57a7563883efabea.apk
Resource
android-x64-20231215-en
General
-
Target
24b12a6b58a37dfa57a7563883efabea.apk
-
Size
2.8MB
-
MD5
24b12a6b58a37dfa57a7563883efabea
-
SHA1
0a93e315530ac6a65f701869bebfd48c7ca40486
-
SHA256
afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830
-
SHA512
e6ba864194558ee1afd82e2edf84412e76c45f3c4d31f07f241bf29fbedaceca855b29e31ef283ab536c7533e326218ccb3a3201634fc23e83fc29f7cfd77cf6
-
SSDEEP
49152:J8ujrWNGlYI9L9kjA5MtSRqzYsy6O7EHK35UPPCaBNNPfjElyDHp9nqHcnReiIQq:JkNahV5/UY9Dj2nnPTplKcnRHI3qm
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus payload 1 IoCs
resource yara_rule behavioral3/files/fstream-2.dat family_cerberus -
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId asset.margin.pipe Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId asset.margin.pipe -
pid Process 4616 asset.margin.pipe 4616 asset.margin.pipe 4616 asset.margin.pipe 4616 asset.margin.pipe 4616 asset.margin.pipe 4616 asset.margin.pipe 4616 asset.margin.pipe 4616 asset.margin.pipe -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json 4616 asset.margin.pipe /data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json 4616 asset.margin.pipe -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock asset.margin.pipe -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS asset.margin.pipe
Processes
Network
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A172.217.16.232
-
Remote address:1.1.1.1:53Requestjsonplaceholder.typicode.comIN AResponsejsonplaceholder.typicode.comIN A172.67.167.151jsonplaceholder.typicode.comIN A104.21.59.19
-
Remote address:172.67.167.151:443RequestPOST /posts HTTP/1.1
Content-Length: 15
Content-Type: application/x-www-form-urlencoded
User-Agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 2 Build/RSR1.210722.013)
Host: jsonplaceholder.typicode.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 201 Created
Content-Type: application/json; charset=utf-8
Content-Length: 40
Connection: keep-alive
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1704431821&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=vjHK0lvEzngPXdf3KYFPAyPaBgfcVK%2Fl7cfZWkZ7pb8%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1704431821&sid=e11707d5-02a7-43ef-b45e-2cf4d2036f7d&s=vjHK0lvEzngPXdf3KYFPAyPaBgfcVK%2Fl7cfZWkZ7pb8%3D
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
X-Powered-By: Express
X-Ratelimit-Limit: 1000
X-Ratelimit-Remaining: 998
X-Ratelimit-Reset: 1704431838
Vary: Origin, X-HTTP-Method-Override, Accept-Encoding
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Access-Control-Expose-Headers: Location
Location: https://jsonplaceholder.typicode.com/posts/101
X-Content-Type-Options: nosniff
Etag: W/"28-qTfHrE6INSRTzBnUDwZIeKeN1Wk"
Via: 1.1 vegur
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 840940a4ea5bdd87-LHR
alt-svc: h3=":443"; ma=86400
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A216.58.204.78
-
1.7kB 6.7kB 11 11
-
1.3kB 7.4kB 8 8
HTTP Request
POST https://jsonplaceholder.typicode.com/postsHTTP Response
201 -
3.0kB 40 B 3 1
-
3.0kB 40 B 3 1
-
7.6kB 8.8kB 26 21
-
120 B 40 B 2 1
-
929 B 40 B 2 1
-
11.4kB 10.7kB 30 35
-
60 B 40 B 1 1
-
60 B 40 B 1 1
-
180 B 40 B 3 1
-
240 B 40 B 4 1
-
120 B 40 B 2 1
-
60 B 40 B 1 1
-
60 B 40 B 1 1
-
120 B 40 B 2 1
-
3.7kB 11
-
51 B 50 B 1 1
-
51 B 50 B 1 1
-
70 B 86 B 1 1
DNS Request
ssl.google-analytics.com
DNS Response
172.217.16.232
-
74 B 106 B 1 1
DNS Request
jsonplaceholder.typicode.com
DNS Response
172.67.167.151104.21.59.19
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
216.58.204.78
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
685KB
MD51221a8143f5ba9aa97092d586920d054
SHA1e53b302d47d078701bd3c096833d3cb4692749f2
SHA256fa23ec08d24705deacb41545a3ca21779e2b1c0845dcd400d27ba2754eda2547
SHA51253af00702725719d386685be945e943cdeb5d435deb9dd4a71ce4b3ab56a3e86efc4da6061ea56f8a82953617ead7f26047c1a32770e77ca70a4d8eb47424afa
-
Filesize
685KB
MD5f1184c0f3cd2fa70c590484035e9d32a
SHA176fa99121538d74ac89a9598f107e2c4ece7717f
SHA2565d7cc286da591ab8f960570810260bda6dff78f51d5b03229841eb84f76ca434
SHA512d17c2c61be6863e945fa514e9d7c1c6dbed1781baf35c8e630cc7c68608aec31f233f1fd2cdbcbeadffe0a0ffc479d06442fe263476691859036a8b78b32ae9c
-
Filesize
368B
MD51905f1cb23fc1e6ab162442905ef6b67
SHA14959c6a32f9877e91068f52885b2dc3f4b87b560
SHA2561b57bb9da2dea8c6dfcd29a2e6a5ec43e1eeda289e3a5d7043d4ad1fa5fa3ff2
SHA512fec39fae5d2e19e80299d7e380e1a57e53d67e5787f54481d3c72aeae31271cd9f8065c0ac307942f9454bead3dc6383dd1d2419f4b17ceb1de658d39ae724f4