Overview

overview

10

Static

static

6

740cbd727e...3b.apk

android-9-x86

10

740cbd727e...3b.apk

android-10-x64

10

740cbd727e...3b.apk

android-11-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    25-01-2024 07:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    740cbd727edfa42ebd9ae6665c0a6c3b.apk

  • Size

    2.9MB

  • MD5

    740cbd727edfa42ebd9ae6665c0a6c3b

  • SHA1

    55636ff9abfb78fa206bc5794021d92f5bebc8e0

  • SHA256

    061a13193d6f743c67c486a64fe50be243132df2fb414ce01b554bf87ba871c5

  • SHA512

    500a38a9f00cca61d43b9a10cb9f6f06bfdc62f35124ab898b8a71456d8ce8d390f9db9c81075d189a8995f21812865822c0135675bcc601980ba9fbdc244547

  • SSDEEP

    49152:bUlFuZFJK2yF69IJS300TEXKJAkSn4fITJYpHfVex4E4k4x//zC1HrR+n0FAYVpQ:bUGKr09z300IXsWWITepuD4kqzC1HLAt

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://193.70.91.231

rc4.plain

Extracted

Family

alienbot

C2

http://193.70.91.231

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • host.meadow.inmate
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4237
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/host.meadow.inmate/app_DynamicOptDex/oat/x86/kDx.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4262

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/host.meadow.inmate/app_DynamicOptDex/kDx.json
    Filesize

    733KB

    MD5

    4d07a028b11e74be051ef630999846ba

    SHA1

    e07f2dae08c5501af368996fc8b33360c8579854

    SHA256

    da1505a00b9c085efde3287ef08020103b7c28b64fa77db07eef0099d2339809

    SHA512

    190821d8b3244965f835b04af1d115340648cc295675292fd5e4444889cc254e078c5be939d7a8efa9be92d16717127171f001322e8d2d6ab6f162655a1a3a56

    Download Submit

  • /data/data/host.meadow.inmate/app_DynamicOptDex/kDx.json
    Filesize

    733KB

    MD5

    9e41d4c26bcb1f57f0769facdb640e87

    SHA1

    4ee36bface37742da0eb1eb0e21294a73289ca61

    SHA256

    c8cc402727a34c4d37969aeae3e3abc0e9e51f487b0f1b552017e3e9b8958e41

    SHA512

    e872a487b075edc1975e05c38567f6927b66808016a1b38a37614a32688bf68c498f9e157c11deb3eee6f3da848181036e394ae6f04ae256856de1a1003fd150

    Download Submit

  • /data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json
    Filesize

    733KB

    MD5

    abc0f9ab4561ef76c5db4451154ab2a2

    SHA1

    9c62171a799b75a734bbe297b95929ead9aa5573

    SHA256

    2bfa72b32fd225d7bae7f2de592b90045f95e2615728617bb349f3b3d40ab272

    SHA512

    039312fb069206fe505936be791fbb2e6b37bd6d7e8a178e9dac76021b8d83d446c2a3099efe04d69ac3d8deba0086d551207db91ca69f6b60da9d5124a72b07

    Download Submit