Analysis
-
max time kernel
151s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
15-02-2024 22:02
General
-
Target
947c8d44144d81f95a93fab15ebaae7fbfb63794f2a1a34eeedecb1007aa608e.apk
-
Size
3.9MB
-
MD5
5accee10223e4527eab88fba93403a0e
-
SHA1
cddd2579a928cca9855f96fc0579d2b668792232
-
SHA256
947c8d44144d81f95a93fab15ebaae7fbfb63794f2a1a34eeedecb1007aa608e
-
SHA512
358bcd1c5f8a4e31670e6b01968d3ade123bc081cb3cd5d080551c84c26a8f6e29dab40acdf8b131499e341d1409d73bc90a08c4265bd1fde86c169943809e28
-
SSDEEP
98304:IbSNi7wdynQlJ0GEswbTK4oytTl/6HnDH:IbSNi7KGgJ0o071t4H7
Malware Config
Extracted
alienbot
http://panamaxb.digital/
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 5 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
fringe.gadget.wage1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786KB
MD57a1dec2283f3fc2ae2837f56969baaad
SHA117d8469d664766a654b03a80ab500162ab775dd8
SHA256ce081f7982ec6f4a0f7714e5424b8f39679b0033293d90e1c4597c542fb6bd80
SHA512a8ebdf3fa4d9e83fc245c4f06484b52110f401eeeddb4a8513df4cb4643eace343953c2574652ab0481502326eb626890680d49b89b404a036899fd9c7e243b7
-
Filesize
786KB
MD59dcb577c3701787eefd9f8030126d9d8
SHA1dd58ad14d55b00c9d35c4ac9f24d2ef02c7c661b
SHA256b2f7a4e2a4ef7f79c99fb3cfec5472d417ee200121ce4477e87260ecd75a4463
SHA512513e467c5414287f903bcdf3c2a5bcb73d1dbdfe47953ac6f63b22641f8c61b9fb66256dd8bc5b22d7acb0c14f2b4cf6b5daa18660bfc04c1c376722ac9999e2
-
Filesize
340B
MD521683fd54d05464b3d9f7bc5ec63c817
SHA19a439c3966eaae8a0cbac0258f773dd8fff17d79
SHA256dad9d0b6ddefe3f7a77e48625a9f9acb2824c32cb11e580c77720baae867a698
SHA512441ddfe0e9596d36c46a114adbd4753b413ca7da09f1803bfebc27608c55cb6ba7b13295061c72a15d3a8a7c7541040e063ccf14cb9aed2c96a8939fb27e22ea