Overview

overview

10

Static

static

6

5e8fbf5138...8b.apk

android-9-x86

10

5e8fbf5138...8b.apk

android-10-x64

10

5e8fbf5138...8b.apk

android-11-x64

10

Analysis

  • max time kernel
    265184s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    16-01-2024 01:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5e8fbf5138cb86522cfc8891f637af8b.apk

  • Size

    2.9MB

  • MD5

    5e8fbf5138cb86522cfc8891f637af8b

  • SHA1

    749412b843bfd62210b8ef47e5ee4527c7d97abe

  • SHA256

    3b4d55a0aaf3ea759e6aaf5229b7b87bd870ee37863d10b1d2f286c742e0add0

  • SHA512

    8f5de80e97da44be96755670717eac230904255c2e79c4c33f66d97c9262da5c13b3938478d24bc6f8f4190fde37441fcf59474489a64ea5cf889d47f9b05cb9

  • SSDEEP

    49152:lbBRZhP56mpt9MADbnfK/tP6QJmV8WZ7HFmE670F9m/3ehYRDxoupSHNVEBQTHme:lvP56EWADbniw8D70avehWDxZpSHNVE+

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

C2

http://194.163.136.78

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • popular.roast.slow
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4251
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/popular.roast.slow/app_DynamicOptDex/eQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/popular.roast.slow/app_DynamicOptDex/oat/x86/eQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/popular.roast.slow/app_DynamicOptDex/eQ.json
    Filesize

    665KB

    MD5

    b02290572cba4ae810c16e5a7545b0ba

    SHA1

    21bed143f93ae9ca734150eb83aa3cadf26c9825

    SHA256

    647bd9419a1fd6634473e3a385799478a75a90ab183a90f6034b70c6ac8f6e5f

    SHA512

    824282591b40636d0bec7bcc8c0b892d42a1bf4843b01abcc7a93fc612097e5a3bd04a4f7b1fff7e13843934f517873ed5dc9f0b532087a58d6f76f4810ff4e9

    Download Submit

  • /data/data/popular.roast.slow/app_DynamicOptDex/eQ.json
    Filesize

    665KB

    MD5

    e8016eb81d199579c71c9304d8257c7a

    SHA1

    3443ca802f19d82d7fe5ec72163d6b612ef49cdf

    SHA256

    72606804df52bca4a8769f76701c86100b4d657a6f75df9225e16cc26188f9c4

    SHA512

    d4ee0842850dba1eb811845ea92db25775c3d5a810930ab35de54b2ab56502fe32162eca988e123e802c6945849d691c525d36bf950430774fd509cc81e7af62

    Download Submit

  • /data/user/0/popular.roast.slow/app_DynamicOptDex/eQ.json
    Filesize

    665KB

    MD5

    28614f1a8b58161bd7fdcc5197f077a4

    SHA1

    1822577e8a2e77ad61023c0f8d5b518dd43e6eeb

    SHA256

    60ca6b1144479830f02938aed4f2979334c6b8b9bc6160ab5a4a572909f0e272

    SHA512

    d495539a7277abdca2d94bcdd82d36c9f3b9532f67a2055edca76eea7effacfccbf050b0597309dd692c8e5d32d491c85e86521384e50ba73643f0f752205f7f

    Download Submit