Analysis
-
max time kernel
4031216s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
09-01-2024 22:03
General
-
Target
3f029ec0fdfef78efd091a09e71ed01b40b2903b33cb2dfab058bd304260dde1.apk
-
Size
3.3MB
-
MD5
33fcb8f3dd910618cd8ac775144ad9d0
-
SHA1
8d631703a738b0b8b3800edea66c1db9f423a308
-
SHA256
3f029ec0fdfef78efd091a09e71ed01b40b2903b33cb2dfab058bd304260dde1
-
SHA512
ff1d6cff175ea2306de90f0c162b8ec12e983e44ac056725461044dbd86a1a7123e435fd772e90e04139839fb53868d630a3c71260beb51fde1cc7773ace109f
-
SSDEEP
98304:k+dM2912PhlGN34mxhi8+NVLpyTTooGnrhAQ4bav3ljZCMqvhf:k+dM2/2PhKh+NVL0UprFljZCfvhf
Malware Config
Extracted
alienbot
http://desturswmew.asia
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 7 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
gift.dizzy.brush1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD58afc832f6c7fb2d2f8a36ad32e8c0901
SHA173227fadf0f130b83f38812ab5e0166f0597b748
SHA256c38a8807eab562967558c6f2e431a63a8f44347c66e847f675d59e319eb636d4
SHA5128fb59dd0535b3503534fc1ea1d01bbf4a05765acc34e5b89cdd15ddcf848be057a735db5a854c5fa9acc2cf1756015881ffafbb01b722308a492c262b594a620
-
Filesize
342B
MD549d7e2e6967dc51eb48e26919ad0b9b3
SHA1a2aec7b74f5fab5dcc415f6171bf5bbd744ba521
SHA256394aebd53d65b7ddc8f0f34a354a13cae31916c25ffdc3cff84904408e8c4255
SHA5125cb6fd6989f25c522f40f863e6fd1017c768caf2226030dc81eff55dc6727c7caa4c189c294092748d492ab4a3f5a3c96759b650cd7abf76e95fb8bcde29fe28