Analysis
-
max time kernel
153s -
max time network
149s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
04-02-2024 23:27
General
-
Target
906fa025f84da7144000a26f2609deec.apk
-
Size
3.1MB
-
MD5
906fa025f84da7144000a26f2609deec
-
SHA1
6e9a59a56e65672ec6f1f002aec438f8e29f86a7
-
SHA256
1a5bf2c57b4851d2e2186298a7cbd438e5cae349836700a5dc6102615ed0c36a
-
SHA512
b46be3f8348f7b8f278bc12a5c50b3df929f82ce8b1e5d6ad8aa12c2aae5c7dcf7f65d1a1cf65d8794f0abe8dbd24d55da30de8d0fda1f5bef38b025a854aba6
-
SSDEEP
98304:0BdJdIpwPF9tDfc6acf+iociKkH0FIbAs6+O4m:cdJdkE9lfracf5zebu+nm
Malware Config
Extracted
alienbot
http://34.107.122.112
Extracted
alienbot
http://34.107.122.112
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
elevator.knee.cart1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5ec7c76f4e62e65bb7222ec4500ed6f20
SHA178ce7dae136b2cd12bd4f9b977022285c7ce432a
SHA25640c9ec7d31704ff8ac0d22927a493995f775f7e8853b1cfc698b688773d83673
SHA512603b77ce53a5cae518f1f358f16740671ad653f566a22b7155cc2c20ecb9800fc66d3f4713a7d970d8784e33a572563966dff8b1dcead1e08a5a1d427dfdaa08
-
Filesize
615KB
MD541fe2ebab1112b7d3baa988fb8171cb0
SHA1f199c2a1f051fe61c9165f061054c3748d3e011d
SHA2563d93a7b102f9ee733ea990ab6d438d3c80347a8b12d2ec784f1ba30d0ce5c2f0
SHA512a85614b9836499f94a2fa7e0db11fbe7a3921e1ac8060a388735a47755eaa9ca97143c67dc7249ccde40973fec4b846d5de80529bfd1bd28905357253ae1f051
-
Filesize
416B
MD5ab4d4e18e876a76860c5c55d62d8e7a8
SHA16bce3aa165d033fc8c5e1974482e36db6728088f
SHA256d811e46566178c1ef6762dd5e1c9f0da8911a7d92ad82768af239bffa3e2c06c
SHA51225555e73c050cc33e3c803b1df24ac7c064e39a6897ccdf16585be6f6f8bc299b57f6fb007c3999cc5a3fef15ad0688accd7d1d713748e0f5e05506f03284f6e