Analysis
-
max time kernel
141s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
04-02-2024 23:27
General
-
Target
906fa025f84da7144000a26f2609deec.apk
-
Size
3.1MB
-
MD5
906fa025f84da7144000a26f2609deec
-
SHA1
6e9a59a56e65672ec6f1f002aec438f8e29f86a7
-
SHA256
1a5bf2c57b4851d2e2186298a7cbd438e5cae349836700a5dc6102615ed0c36a
-
SHA512
b46be3f8348f7b8f278bc12a5c50b3df929f82ce8b1e5d6ad8aa12c2aae5c7dcf7f65d1a1cf65d8794f0abe8dbd24d55da30de8d0fda1f5bef38b025a854aba6
-
SSDEEP
98304:0BdJdIpwPF9tDfc6acf+iociKkH0FIbAs6+O4m:cdJdkE9lfracf5zebu+nm
Malware Config
Extracted
alienbot
http://34.107.122.112
Extracted
alienbot
http://34.107.122.112
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 5 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
elevator.knee.cart1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5ec7c76f4e62e65bb7222ec4500ed6f20
SHA178ce7dae136b2cd12bd4f9b977022285c7ce432a
SHA25640c9ec7d31704ff8ac0d22927a493995f775f7e8853b1cfc698b688773d83673
SHA512603b77ce53a5cae518f1f358f16740671ad653f566a22b7155cc2c20ecb9800fc66d3f4713a7d970d8784e33a572563966dff8b1dcead1e08a5a1d427dfdaa08
-
Filesize
615KB
MD541fe2ebab1112b7d3baa988fb8171cb0
SHA1f199c2a1f051fe61c9165f061054c3748d3e011d
SHA2563d93a7b102f9ee733ea990ab6d438d3c80347a8b12d2ec784f1ba30d0ce5c2f0
SHA512a85614b9836499f94a2fa7e0db11fbe7a3921e1ac8060a388735a47755eaa9ca97143c67dc7249ccde40973fec4b846d5de80529bfd1bd28905357253ae1f051
-
Filesize
363B
MD5ecbe030a42560d3ad7462a9c90b3a59b
SHA116d0a4776cb808fdb017ca76503f42e1cc94c952
SHA2562bddc14136b76ecce4fe38353dd17e9ecb1f426b063f3eadac2b44b3c1f0fd9e
SHA512047c811a283b9e3430be71ee596821edb6e1f4898770674af78b63dede096ae36ff09668a81b335879b6986a7e10374389386bcad49898426e3a763afe7964d8