Analysis
-
max time kernel
3831056s -
max time network
142s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
07-01-2024 14:32
General
-
Target
493b35f8fae4f4d06e36e98082560f4f.apk
-
Size
3.6MB
-
MD5
493b35f8fae4f4d06e36e98082560f4f
-
SHA1
eff6ed1e028eef7e7d987b6e14c44ac3a828629a
-
SHA256
ac2cb2c60ede6b43143cf2b98d56932d3f5c97aee0c5f4319e5539203cece079
-
SHA512
f41399a73a4169218564de4bae3f54cb6886d90f4b6d35200ee48ac3a3f11ace2c5f73fc08047c42f727618ac536f7354cf6ae1605e21537f486712b3691a04d
-
SSDEEP
98304:moYHqJY+PhhqidZzR8sD3p3uq/ZAl8lEDw:QEPh8idZV8sD3FTZq6Gw
Malware Config
Extracted
alienbot
http://rndhsadjersxexdd.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
garden.Soviet.carbon1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/YWUALlpGNxnCqPA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/garden.Soviet.carbon/app_DynamicOptDex/oat/x86/YWUALlpGNxnCqPA.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
564KB
MD5064ae709730531e65fd80a8791844fb7
SHA120b8cda6e62dfa0aba44fdc936c7ee8c7061c637
SHA2569a797a8cd64479d60a20f3da5bcbb559a7f2f58a6971168f54d0891602d34144
SHA5120ef0b33792b95de3b2b3477d3a08f4daad60ff3ba530500e83c7d4493b690dbe8f684dfe05657f1aa543b25a0ca857d2bdbb0aa7f39daec6af25ba58512f041a
-
Filesize
564KB
MD5bf59cb30d338df86aaa65cd50c43e25d
SHA14f97395f5a69064b607c02482433b465d1167dee
SHA256d4e3e821645974f5fd9b028ef0ba570476076bcc5193aa37cd221553f94d4fef
SHA512477955e47f0d9a6f390e47aa31ba0816aa3f0196be9d47ba02057eeaf2fdd41c7f110d678251c1b44f46f75da34095977e5add69654fa039d00ddb347b94ab03
-
Filesize
1KB
MD58f6c5af98dd6f00d57224d731a22e909
SHA1a4e1c533aa96eaf7c8c6d6a8c3216f8d78dc6e02
SHA2567afe803272b7e7999e76a43c21426189a1d6131bfeb7678396183fdfc3892088
SHA5126d2d469df09e1712386cb4ef9f76a4b38e6d97478118352bcd94423e9cc724e7b49e4df2607db918e35b737a8df8909d20a6095146f4abb15678d62688c40169
-
Filesize
767KB
MD5b253a4b7c84dd415085d256a5023037a
SHA1f2a04ec92d580918279f6f68b8002cb2524957f6
SHA256f7633a3c721aee3cb17d6e1a163698b12f84fd4462e54bc85e3bc85189f85879
SHA512887699695644c262024e08e62df3b529a6c0cf39841fb4d89c9167c38dae644c8cef091c63aa1c444f623041e38a0a2c88ae5f3230d59687b1b9a2cda295a755
-
Filesize
767KB
MD56427b5bc340dd58e0e0760cf41741e6d
SHA17abfe8b374fcc4bf262226e7a8370bcffb3f852f
SHA2562b0b3be826276b792d4851b118b0faaa2d563fe239a83dc74e2c8a0501534255
SHA512caf892e863acb34d98624d928a4d7d7657c67d84078d4b6ba5288b631c69c143fd025cd1aa911c790456307e9460bc33a67f70eb3dafb80d0b75091ac76a5ac8