Analysis
-
max time kernel
153s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
28-01-2024 06:19
General
-
Target
7c5e83a49bbe44113c444524cbe7124b.apk
-
Size
3.8MB
-
MD5
7c5e83a49bbe44113c444524cbe7124b
-
SHA1
3c03d0bfc54f5fccf029f14f9a996c70d4f16014
-
SHA256
c10a976dabb58f3ea812ed548287842a65903214ac1a92bf2d499f87787a50f8
-
SHA512
dee77a1910bb6e552aef192e1cca5fa02277db5fb79de8522735429baa8b3ec7b0dbcb03eaab707c441e01f52828d7828a7089dd37b05023ceaf80b57c7e877c
-
SSDEEP
98304:8Cu1BeWBFCXIaVzW8lOqX/31qbm8fGH7b/5:4I7dV1qGbbx
Malware Config
Extracted
alienbot
http://rndhsadjersxexdd.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Checks Android system properties for emulator presence. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
understanding.subsidy.questionnaire1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
563KB
MD5ed38674de2c76109cb0e993489b42ffc
SHA1010886708c1c2d076c6f856561e7073ce2b5b98f
SHA256ff812cae7494ff099e79bfc0e01e25fcf2b5b8aeb5d555aa53a0039410ae1812
SHA5125c49cd218b159c09c45533eec43cdd49b17ba8d77f8f1eaacccacdf1b8c84b20e6bbf163b08e18fcca8f5ddd658143d238254d313fb15c125a48f0b15ed29381
-
Filesize
1KB
MD5389dbb369242807842e6a0009f43ed3c
SHA1623042f3784705e71ea332cf5d84dd205dd539ba
SHA256e57635b12c15a532ca5a3a762fd9101fd6dce9d3d897d52fcf5f85484e430a1c
SHA51257fe485ecd09c21fe1bdaee916a3342b446ecbb7a8fa8ce70b40c1c8b6b968896f5c25b3e6f0b50e8aa23ded6c5ae7903d4eb02fa28e0ea907ab10aa93af0332
-
Filesize
767KB
MD5e05d87daa998d977061397a0140e9528
SHA1e7510c986edf30a66f8f7091f82fb062007062a8
SHA25672cb3743d4259011529a2727c31eb7fe791166fefaa44d6f8a2d40e5c093097e
SHA5124077bc7ac1125b0ab8e035377188c5b3eb331502bc1f379fa604dd8b1fd9912569b28a55c9d6cb7ae2596ec68231c425b925cd4767a6f9c17d34effb013ba856