Analysis
-
max time kernel
4144385s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
11-01-2024 05:34
General
-
Target
52abe8e7b491c4674f924c7c116e0998.apk
-
Size
3.2MB
-
MD5
52abe8e7b491c4674f924c7c116e0998
-
SHA1
790ac6997c1b9042e157e4dd2f314d5077155ecc
-
SHA256
90ddf3acf9053e3d61ce3a125bd4998c71e75621567040cd31d3d27e76d3876f
-
SHA512
d16fc4e8d3a53129babcab8ac128820089060f39825487e840af199c62f9b763e71aeacdec5389ad0520cbf36ff6e8388e5f7c299354fbcf6ab421527cfd6226
-
SSDEEP
98304:9pg60BgELESYXj60Y2tGiR640ejpcBtmHXTIl:9pguSyj605tGiR0Eqrmcl
Malware Config
Extracted
alienbot
http://34.89.218.199
Extracted
alienbot
http://34.89.218.199
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
fade.air.cage1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382B
MD552585cd39c172251130465539e7e76db
SHA1208e320cacab15c9c316053a0c7e08314e06ced9
SHA2568f0fd998d063f8d03c7b239595f099d0c5b88f30cdf4b655f0ae104540e133f4
SHA5121126939eb37ee72c5c17b2148cbdc0d1a2b16c915810a1e57c2ad1b4ea7dfebb3e410f26261cc912dff098b20f9855fa8ddc0b4809b133c49a5eb5d5def9f5ac
-
Filesize
691KB
MD5c57990f73f9b1c60da87c84c045999c0
SHA1654c1d3a52275adfc1cf48dac6ffd07b3f224437
SHA2568c40144ff045e1c8dd6b12c99b84b6006f55593c0a1754b24118f0110bbe3684
SHA51213726bc7bd339f29e9aad6f784d9ffe4806468174cd290a0065bb6d526ce6b34e33d3362d154084f648f1b9ca167fbb2961e5b353c44b0a08348fce2f35c8179
-
Filesize
691KB
MD5314b1deb1a7b635f110cea727459c0f6
SHA188fab22d0947462299929a755918d8b8435d3654
SHA2561bbaf1ea599f6be74be58e4566de7aa7fc72bc93ca3477ef4548f6e693c6338d
SHA512775d24d7e4c004297a48208ce2f1fdf94c89f7f8ab049d375d3fb27af7c12374df1c72c0dd4294dea3441e8475651cd9b2f692fdae5bfb542250eb58eeb2516f