Analysis
-
max time kernel
58s -
max time network
135s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
08-02-2024 22:10
General
-
Target
1f9749e79441b7ad455ff8bd6802e7bfee98abd2d9832b270389078033a2d794.apk
-
Size
1009KB
-
MD5
b21329c916c0a083e42e817b8491981f
-
SHA1
3aaf1f036dc8cffd0a777c5bcb67039888faf60a
-
SHA256
1f9749e79441b7ad455ff8bd6802e7bfee98abd2d9832b270389078033a2d794
-
SHA512
0c90f7d0b263beddeb0330c30a4a8331ad37f28e6161666928a38faf9ec2608f4eb0a5094735d2f9a196b495d198e09d6e25a4b36e024fc16bb76a917a0b95b7
-
SSDEEP
12288:OvrGcc4LVwwKvZxWcruFb6CAjAbvqvxMgaY1ZPDshjLM8veYqS0DQ365muQY:oGUVw9LSFb6CaksxkiPY3TGVQK5muQY
Malware Config
Extracted
alienbot
http://mynewpath.top
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
love.annual.layer1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
553B
MD51f8f2b9ddac47e62c727849e6b783fcd
SHA17f1460e6823a38789d4ced5fa547e700bd88d077
SHA256b2e12f5bdbbeb1281597412769f1b2f0de8029501648676f633a5b38c49eba54
SHA5122f476e5012573a11efff129205dae8e9368f51210b88a61a9cab2f7ce015147a8b32fbb332ec880b3dcfbe724bd2e0de640205a76b96124fd8a967f03e681824
-
Filesize
491KB
MD5de4a1f3d3166fb206fa8037b2d1b7ce9
SHA164093497e098c974190c7703ef8e562cfb6a06d4
SHA25669f7cf032132cced703ebac28b47063dfc54d9054f992a34a605be2ea66a60f6
SHA512c4a9efed4266c708ad1a03e8571df6899936d26c62f9954cf5c0f1b0970b15afe2ca6a19d03883706cd092e52d3571b8a0f78703fb5bd957f6f735ea436c9e0e