Analysis
-
max time kernel
136s -
max time network
140s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
23-02-2024 22:03
General
-
Target
beb41073bb04429078a1dc2b781ac6c47da3f34cfec7347bfa7a27ca29f02496.apk
-
Size
4.9MB
-
MD5
983411f142d382b114bd2f3b3242dfca
-
SHA1
5658da4cbf643263788bc35b1f6225b314e04559
-
SHA256
beb41073bb04429078a1dc2b781ac6c47da3f34cfec7347bfa7a27ca29f02496
-
SHA512
9714c36b4e472170be06a48b5ca7900d2fbbc81d7dc7480f710e1fce87cc6134ca41460dad737d633a3a33098ba4655438a3a50027fa6dd7a85c88e45e553b05
-
SSDEEP
98304:f41xY6ILqyZKQwtuKJ2JLSJKrBZ/S/G98ISGn50XYd5brdx+jWjrTuaKKMOB95a:x6lyZ7y/2mwHopodR3Pjrqa3MOf5a
Malware Config
Extracted
alienbot
http://buuc5x0r7x98fj40mg2x.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 7 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
org.extraordinary.immigrant1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
703KB
MD552e9cc7cfc16cd16294d4330a15888a1
SHA187d479b96036505d9249d979066217e27bd60687
SHA256789bdc300c01ba4a050b9edffe4dd08e0a661627d2068959b6ac81facbbf9338
SHA5122a4c6de16f9eef97463a5a7a4c9fc02e47fcb66f1b32056874f003260694f82d7fff1d5e1a937627506e76fee09d3e9811e743cabd41e61fbd6ff2b3687cc3a4
-
Filesize
93KB
MD54d6c7f5bee4d210aa38217ce97784a61
SHA1fcdbf2c1027e10ca75cd7965360788fcd37e4e31
SHA2569043fbf0d03c2ea85db2feaa3e1c9dfd72c664e75800629a304718cb0b1630e0
SHA512e1103025ce82c9faa9f77d58b725d8cfc60596146bd34484f21bd2e2e107fbb011737e98c8bb8830c3bcbf2b8bce608ddc5ce61b685f9cd2ba82c93074bc5ba1
-
Filesize
912KB
MD52e058424d1caefdbcd0c82e4b9641076
SHA10f3a738c453d2b0673860893b608b0a455f0cd2f
SHA256a736cc722cfc0cdb57331fd3af978b422879c755240ab7b18b9b867e5657c17e
SHA512434f167a010229da13f2e5a74704614668d4a32c4aaf317d1415fa9c8d8ee998706fd83a7c9f8c3f2d2e3b3909e2b7c957f960659759850fc313971ac9ffc0c5
-
Filesize
243B
MD5e6d31344573bb63886ee6a4adffe6c2e
SHA15fc1f7c4ab5ed7d0e5ed717995cedd2663352cfc
SHA2569068bc524da999bd87ed2a22b71d5a36d8da65d035c4fb0fe484f20a682b482f
SHA5125f1707471da075a0a3154d1111a3dd836cfaa256ea1bed127694a717c8374aa5e594b07f463dbee2aaa3b5d41f885164aac29fcdc90275942721efc897f8336c