Analysis
-
max time kernel
141s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
25-01-2024 16:42
General
-
Target
74ff2c72c16aa2909fdb5adbb83f122b.apk
-
Size
4.3MB
-
MD5
74ff2c72c16aa2909fdb5adbb83f122b
-
SHA1
eafc99acfb4757ee27bce2b2bbac0e08bd6f6b52
-
SHA256
1a79724595a99052723f2422d57ec93b1f62e1cdb2121ae9ae2175b107e60a00
-
SHA512
f3b3e8d3e96c54c49963c57d009c1bf0fc5993c208fb715630490f1a724efdeffd3f39b4dd7fad2135c81b0b511334bf64d57e5f513c8902f6ebcecbf03644bc
-
SSDEEP
98304:eiyySaTQmA1mTEw07N01PtM2G2LqUrSUjvbLqs50MISGhGv3Jn:cyS/CTEtN6FvGLvKui3Jn
Malware Config
Extracted
alienbot
http://vgokkycl61ck.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
diabetes.circuit.opposition1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
616KB
MD5273406afe24fcdee96153fce14d82b6f
SHA1d855da7ec8f9a050c27d1a3c81fb3895661ee9f7
SHA25637ab0f8ade5519d7afb299ba5b1a7786d9dd29d29f2552bcc7e6ad0545aefb9c
SHA51206adb8f48cb3b598a35ecc98b88574776047e190710a64c003b4b2810c532b33c7bf930b88b341894bf1255ff6cac9859f5a898fd0ddc1a403f9d1707a27c2e2
-
Filesize
616KB
MD547d98dc2878c844a49f64ced70127ef7
SHA1f70f36c6523da3c2eed2f6c098ffbcd4cfe64840
SHA25627a07a97d1cd87e06fcde905c11e70837f5946f65a1f04fc807ad5a019d34c03
SHA512a47e2e070de2b9f62f536e8a5991c9e5bd21401ac002efcb72faa9578a2b668e48bacf08f142b227f0936ea70932e48a3abc29e01b2fe56c0d663d99df188517
-
Filesize
767KB
MD5f1e486f50ae2b084c0631187171c56c1
SHA175703853a7a55c9187872b29fc359c5440de95f3
SHA256d962ae29e56819a799250de6a6141b0767f805360296c1b2464728e892a0b551
SHA5127a28eefcda443cb0ff5dccb6bcd72676590da4ff7f293f316cf8facb2f4a29a356ca36f0e675a5cb7dbba7bb781862037293d1420f4d729cf25518be81432fb1
-
Filesize
248B
MD5ffa47d3b2c1729f1a68aeffb2d7475c1
SHA13177a8f6b9871e7b080ae1575e7c2da2fe60fca8
SHA2562c8fd5f95493cbd6a773d1eff66c1c157cbf25495d4e805841fce769c92ea54c
SHA512c520ab00b419a545276da0348d9b48a8aa996da981210ec7a94b1c0725e089d69f4dde6b8168077538142deb63f76d9c2fa6219983759191d155d8c8172c9731