Overview

overview

10

Static

static

6

9b3baa70f5...98.apk

android-9-x86

10

9b3baa70f5...98.apk

android-10-x64

10

9b3baa70f5...98.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    14-02-2024 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9b3baa70f573d608d580054af58a8b98.apk

  • Size

    3.0MB

  • MD5

    9b3baa70f573d608d580054af58a8b98

  • SHA1

    d743eb9a025a156a0beae18022dd05b0b91487f6

  • SHA256

    da43b86847f10c4578be3c80104729f243c6724d9f151bf8cfe087d09a9f74b9

  • SHA512

    355c3f9f1b8f87758b2f9a4711544157aeb0b996f7681c6a3ced35b7680006ef8ca82dcc521044e5315a28f2a51ba1d07042fbe6d3d1cd3de2bfe414d089d351

  • SSDEEP

    49152:LlUlKomduypj6e/HpxQvtPJ7fxMUnjDCy+3llQJoNcry2V9ago4fwQJ5DYYSqzdF:Umdzp/hKtB7fxnjWyEiJo+rXvoPAK0zP

Score
10/10
alienbotcerberusbankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://buralarnelernerelerhem.club

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Checks Android system properties for emulator presence. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • group.finish.index
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4215
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/group.finish.index/app_DynamicOptDex/PWOCbS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/group.finish.index/app_DynamicOptDex/oat/x86/PWOCbS.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4242

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/group.finish.index/app_DynamicOptDex/PWOCbS.json
    Filesize

    733KB

    MD5

    c9551a9688b56dfb5563db0fb313a346

    SHA1

    3014ae052742bc195219ea7c9eaef7018496be4c

    SHA256

    5fa92ba0bc6344c852d7bdfe2b934fac8bf1252b6c96f7a0fd1b84ce158e58f3

    SHA512

    85cd42b4a04bbf2da38e6b9f74febabd965ebe74897bbacd72e68d5509d84c3b064e68840578dfa45ed74d3705503a5d81cea00e1eb0dd6b9ab3ae6adb375641

    Download Submit

  • /data/data/group.finish.index/app_DynamicOptDex/PWOCbS.json
    Filesize

    733KB

    MD5

    145268dbc6eaa50de1df4f9c41fb9c46

    SHA1

    4efbb3a97f6efa0b6c8e387d7f7a303a83017e4c

    SHA256

    c3b27dc580522a844764b5c98df311c53a25715f134148c0865d97e428aa38fc

    SHA512

    d7dd7c529e1a0b9812e1796704460ada699db83142cfdeb97bb93b4e05da2c063b4adfdcbd83d696f7158a6f7e5ab0a4b8c535b9e4dd93eac957835a53eaf5b4

    Download Submit

  • /data/data/group.finish.index/app_DynamicOptDex/oat/PWOCbS.json.cur.prof
    Filesize

    526B

    MD5

    f4f00084a141285b0b23b2e85a78671a

    SHA1

    1057a2073c1725e6ce678064a90cf1b3fa98515a

    SHA256

    0ea1a45c9adc228ba97b8e7eb5762734a5202f414663e80f11bc969d3f2bf3de

    SHA512

    27b36bfc1be27ad4965b4c93cb47348d9254085802305ba04456f7729153e6369a99d92b0994d9d107f3b3e9c59c237765ec0ab9105083f0e7c4e5207a85a1fc

    Download Submit

  • /data/user/0/group.finish.index/app_DynamicOptDex/PWOCbS.json
    Filesize

    733KB

    MD5

    e9aa19f25e68dae2419ad14775563637

    SHA1

    5a3fc5a4b4a264e5e4d6f076bce1bcdb43b120e8

    SHA256

    d74e6df5d6ca38b9d5d0e3a39fba1e8214fd026ca4d86c6cb8537cee961e53ab

    SHA512

    405414ef33680bc5fbf781cf51b544eb59f02d2327ae90a74a9c94db97a026d5f6ffbf3f64795e558da4c4cc0fec1096cd3d1c7ca83870a41cbf0527010af569

    Download Submit