Analysis
-
max time kernel
4167684s -
max time network
138s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
11-01-2024 12:03
General
-
Target
53771109f84c37ef7a1181a3c2dbc35a.apk
-
Size
3.9MB
-
MD5
53771109f84c37ef7a1181a3c2dbc35a
-
SHA1
126737f95885214b12dbd30a3929dca204f71103
-
SHA256
78e1c4d6b90d322bfaeafef7bc49999e73299f76945ea0e8d8e82f7bf4404703
-
SHA512
6c9b3c2bcfb0dd21c540f812f4feec793c124e372ddc1ea23dea043265f4c20c81614530b5b139975a784d60f25626a2ba33a9dd58b978f43e34f45a647893f5
-
SSDEEP
98304:3SsshveewCWgLItH+JEi+wFshD4PaNZqMknNQkcOP+tfHdg:cvIv9tZGPaDuNBP+FHdg
Malware Config
Extracted
alienbot
http://m4k0b0n1k.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
landing.eastern.ratio1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/landing.eastern.ratio/app_DynamicOptDex/pCmJn.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/landing.eastern.ratio/app_DynamicOptDex/oat/x86/pCmJn.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54bc4c9875145f959f3311381a07b9131
SHA1a78a05e6484211577b4497b960b06ecf970e92de
SHA25616ac890d2bb292107de562ebb9224fe9b6e6cd4f71d86aa9382e5dfded39ed95
SHA51260cb496b399dee61812919fb7dc8f496ca7bf7f6a765ca04e1dcde219a4ba8734ddb97e5f71cf21a409d2f4e2f95a872f6f3492574006df28f859fa87c651221
-
Filesize
615KB
MD52b4c18d38d6d52aa66bf5aa07fde6294
SHA1f596504c19d18c8a28890ca2eaa16955b8d5c1cd
SHA256d2e1a6e9227ab7e54c4b9938609363fc32d80fb046bfb99adfab29118d1d9ed7
SHA512885c98cabbaa49c9dbdd599c7b1f59767af0d1a0e3eacfd6ea0bbbcd36fe571cb0f7f75b5f0f246d656d6fb18d63653b843fab1fa0b0be113b30bc99f99a14e5
-
Filesize
615KB
MD52f55e5289ba54142875ff2cd24781c27
SHA1babcecfcec9145bd660e5a66eed4e6f120bfb4fd
SHA25674dc59794f898b28220669bda683740056fbd7db360dd0829185207b4f853648
SHA512f75f211f7447631df4c156c98036bc7b730c55a3e454c59b228c5a8e5663b2247fddf6548a6ceaf690edabaf0323b02120d46d9087ae3444e4cc93fc4f44e066
-
Filesize
767KB
MD5ba7a6524d0cf0abcad08ff1ddd7da4a6
SHA1f450d58b89b275d825270c944f4212c2a7fa3b1a
SHA256ce98245d01b134ad98069fd5e377d2673af16b019f690fca219895ca43d959bd
SHA512a89759975c1f1254607d77a478355380cb56c46157d22b1ee40907dd47848920c56396db0766f11a0789371fce78f35efc179f3b3871551c53df82a054d1880c
-
Filesize
767KB
MD50c0bbe24c86cc50e9c0586951b5d3ed4
SHA13a06d0ba5716f289291bebec1e84ad371eb274b9
SHA256a8df95a339adbadd5c4f011221593a3d76855e4af4f549299f5ceeeefedd98eb
SHA512f2fa820d8bae66207bdff2f07d14fded2c03b2a2a8c81f056f23ad5081ddccb82b200f5a548a55376079d9d7d075251010d94a3d4a156ba90662760a14fc6e3c