Overview

overview

10

Static

static

6

906fa025f8...ec.apk

android-9-x86

10

906fa025f8...ec.apk

android-10-x64

10

906fa025f8...ec.apk

android-11-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    04-02-2024 23:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    906fa025f84da7144000a26f2609deec.apk

  • Size

    3.1MB

  • MD5

    906fa025f84da7144000a26f2609deec

  • SHA1

    6e9a59a56e65672ec6f1f002aec438f8e29f86a7

  • SHA256

    1a5bf2c57b4851d2e2186298a7cbd438e5cae349836700a5dc6102615ed0c36a

  • SHA512

    b46be3f8348f7b8f278bc12a5c50b3df929f82ce8b1e5d6ad8aa12c2aae5c7dcf7f65d1a1cf65d8794f0abe8dbd24d55da30de8d0fda1f5bef38b025a854aba6

  • SSDEEP

    98304:0BdJdIpwPF9tDfc6acf+iociKkH0FIbAs6+O4m:cdJdkE9lfracf5zebu+nm

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://34.107.122.112

rc4.plain

Extracted

Family

alienbot

C2

http://34.107.122.112

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • elevator.knee.cart
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4255
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/elevator.knee.cart/app_DynamicOptDex/ZErGy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/elevator.knee.cart/app_DynamicOptDex/oat/x86/ZErGy.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/elevator.knee.cart/app_DynamicOptDex/ZErGy.json
    Filesize

    615KB

    MD5

    ec7c76f4e62e65bb7222ec4500ed6f20

    SHA1

    78ce7dae136b2cd12bd4f9b977022285c7ce432a

    SHA256

    40c9ec7d31704ff8ac0d22927a493995f775f7e8853b1cfc698b688773d83673

    SHA512

    603b77ce53a5cae518f1f358f16740671ad653f566a22b7155cc2c20ecb9800fc66d3f4713a7d970d8784e33a572563966dff8b1dcead1e08a5a1d427dfdaa08

    Download Submit

  • /data/data/elevator.knee.cart/app_DynamicOptDex/ZErGy.json
    Filesize

    615KB

    MD5

    41fe2ebab1112b7d3baa988fb8171cb0

    SHA1

    f199c2a1f051fe61c9165f061054c3748d3e011d

    SHA256

    3d93a7b102f9ee733ea990ab6d438d3c80347a8b12d2ec784f1ba30d0ce5c2f0

    SHA512

    a85614b9836499f94a2fa7e0db11fbe7a3921e1ac8060a388735a47755eaa9ca97143c67dc7249ccde40973fec4b846d5de80529bfd1bd28905357253ae1f051

    Download Submit

  • /data/user/0/elevator.knee.cart/app_DynamicOptDex/ZErGy.json
    Filesize

    615KB

    MD5

    845eac45eccdc90d8a96cc60b2246e63

    SHA1

    f1e5610506f5969f640d19a82b37d368f3359c3e

    SHA256

    33b1585506095fe8ee91602bfe291ed5efd081e1590fd603fe8b72d45f184d9d

    SHA512

    599198b553a0010c3a70e05e42fb4f66675b4fd6ba2aad815427315bb6d658011e164a5f8817d96ac8de25d07e62146a8cec002ae825706bae90faa1f0d5a16b

    Download Submit