Analysis
-
max time kernel
145s -
max time network
135s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
25-02-2024 07:49
General
-
Target
a33fa98242f62443e0304aa0c886e204.apk
-
Size
2.6MB
-
MD5
a33fa98242f62443e0304aa0c886e204
-
SHA1
7c0ec3f1f1610e266cafe77991404d53b635b9ec
-
SHA256
0b018c290dbb5aa2af3f324f2a83c6654d5a47e4026413a6a082623bf2e35787
-
SHA512
82273a0e16b0c131bdebf51981ca99c7e2ba60092353382388b336af10547f7108850c6994ec6ddac4e34f571d9928637c4d6de00117a3d6230c3cb21f510b78
-
SSDEEP
49152:vZ+BWZHq+s1pBFu0uls9FFFHc+MxwjHFkaZNG8jIuveCFv/LNIvArN+qh4Xyb:vcBWhBe97KwhbZAfM/LqIwMb
Malware Config
Extracted
alienbot
http://feawetawe.sbs
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 9 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
crime.fashion.dentist1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694KB
MD59fd66a415ef711423bd7973ce48c5573
SHA1ca4e05ee4e101cd51e81c564e7f4da065124ec62
SHA256e40821343e602cd3069fc6eb308d2fb9a8fbf1773463bc0a08296b3e2b671c91
SHA512d1573c6ac3bbc045ede2e101a064a0a4c54607847c76e57f2bcdf8da9a6ac2120f004d534e43588e8b333c454a008c47b0eb9fffc8277eab7ff98469af37225c
-
Filesize
694KB
MD530f0e8f8cb5a5cc795e109ba5fe68c90
SHA17587ce3e1071f4196c3bbffc1722cedcad65545f
SHA256c28e626980d7fe0f86c698d2aba70fff6a90aa18ae0bf1a2c23acc466607dff8
SHA512d86ee0a7cc321687f697e083ed6135cf611ed2fd4a6481db40830bc75c3b24a2a8741e7e8bf0d4ea9496ada695f51eba6deb9a73f9e7392d38c2bf173e282c22
-
Filesize
386B
MD561c986652f18e98d40df197e3d261204
SHA1038b517859a8ce795a0352ae97844fb65fab5cb0
SHA2560ed9b5c655b487eb0052f1acafbcfef96b88e379254c2dc781c4a1716d8f513d
SHA512e54c24337ee6bf235406f355ae559c813f5be5ff3942eb34c30bcb8a2afb72dc4ac2533fae3577405429c0cea1d8cf989438754a80af110934db230856aa80c0