Analysis
-
max time kernel
4144386s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
11-01-2024 05:34
General
-
Target
52abe8e7b491c4674f924c7c116e0998.apk
-
Size
3.2MB
-
MD5
52abe8e7b491c4674f924c7c116e0998
-
SHA1
790ac6997c1b9042e157e4dd2f314d5077155ecc
-
SHA256
90ddf3acf9053e3d61ce3a125bd4998c71e75621567040cd31d3d27e76d3876f
-
SHA512
d16fc4e8d3a53129babcab8ac128820089060f39825487e840af199c62f9b763e71aeacdec5389ad0520cbf36ff6e8388e5f7c299354fbcf6ab421527cfd6226
-
SSDEEP
98304:9pg60BgELESYXj60Y2tGiR640ejpcBtmHXTIl:9pguSyj605tGiR0Eqrmcl
Malware Config
Extracted
alienbot
http://34.89.218.199
Extracted
alienbot
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
fade.air.cage1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD545205200796628cc9dc52254543131b8
SHA10838abfbe135a0ce8bd7d9dce58e56e83c4312fa
SHA2566e7264145c3b4f010b79644a53574927bbdbd0a764f1f39c6934d3bb98bdd595
SHA51219c72a96b48e6b837256c22792eb1afd83b098bdb355512f8185cfdf3d5af38fc392551e4f5cd4bc1189736665d34d406db6b9e294d569b97626498a33828e1d
-
Filesize
691KB
MD5c57990f73f9b1c60da87c84c045999c0
SHA1654c1d3a52275adfc1cf48dac6ffd07b3f224437
SHA2568c40144ff045e1c8dd6b12c99b84b6006f55593c0a1754b24118f0110bbe3684
SHA51213726bc7bd339f29e9aad6f784d9ffe4806468174cd290a0065bb6d526ce6b34e33d3362d154084f648f1b9ca167fbb2961e5b353c44b0a08348fce2f35c8179
-
Filesize
691KB
MD5314b1deb1a7b635f110cea727459c0f6
SHA188fab22d0947462299929a755918d8b8435d3654
SHA2561bbaf1ea599f6be74be58e4566de7aa7fc72bc93ca3477ef4548f6e693c6338d
SHA512775d24d7e4c004297a48208ce2f1fdf94c89f7f8ab049d375d3fb27af7c12374df1c72c0dd4294dea3441e8475651cd9b2f692fdae5bfb542250eb58eeb2516f