Overview

overview

10

Static

static

6

ae558d6f04...21.apk

android-9-x86

10

ae558d6f04...21.apk

android-10-x64

10

ae558d6f04...21.apk

android-11-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    29-02-2024 10:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae558d6f0465295f8f01d58c3ab7fe21.apk

  • Size

    3.8MB

  • MD5

    ae558d6f0465295f8f01d58c3ab7fe21

  • SHA1

    67e9336c1d0883fc627edcadb9507747d700b136

  • SHA256

    fc226b880cbc3e7708265d3e9c4e75cc2c115be2a05afcdc17212e4a11ba2bc3

  • SHA512

    be2072bedc843d257db5a7ed431e245fef9ff2797f07b8a2a730ccbe9ae5a1b47dea47c7500c9d2179f7a605081b14d5c446fe2fd81ff6f2d168a3181e1d4530

  • SSDEEP

    98304:uLavM277jQZuwOiawrGKKGXppiJHbs0/iEd:uLkMi7jQZutD4RD06Ed

Score
10/10
alienbotcerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://mamarhelindal1.digital

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • race.alien.cave
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4464
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/race.alien.cave/app_DynamicOptDex/BP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/race.alien.cave/app_DynamicOptDex/oat/x86/BP.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4492

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/race.alien.cave/app_DynamicOptDex/BP.json
    Filesize

    695KB

    MD5

    ebc67699981cdbc76946f5d7bc199aa7

    SHA1

    925105bdb9ac67f9354a7293e9bc756969fc4284

    SHA256

    f5e52d984d6d894a2cc5b1fc827c659a1d0a6e1b69fa3c8326befe82a2b30fc1

    SHA512

    966fc553d33efb2440765d30420d361df1f5c4965e3edaae91e1ea769001afd2a85995f008bd241f611bccca90f81917b1a1235b1a13182c208a62455dc30174

    Download Submit

  • /data/data/race.alien.cave/app_DynamicOptDex/oat/BP.json.cur.prof
    Filesize

    451B

    MD5

    e5d9e99033e29af3938d678138620ac0

    SHA1

    54db3932e00048ef71142272319a3d3b46b3d3e0

    SHA256

    7e87d9f2696d78587977feb0013f7f4b834bd5fcee90c9b4c7073570c17e723e

    SHA512

    16f899d87c0a83ec2a5d927e3cb355147fc533caf152df8d3b0aa0b7dec524881b18b85bed03f47382662010dca71b560b5d6a1e5de37a7a417de771d0c0fc12

    Download Submit

  • /data/user/0/race.alien.cave/app_DynamicOptDex/BP.json
    Filesize

    695KB

    MD5

    64ea1fb6ccd0d453e7d5902e4e6aac83

    SHA1

    d6de9e1a1cd1f2d9cf9a572aae2019bc2051fdf0

    SHA256

    5de04cdf67628b192d348975d0bf33f2e89cc3855414a4286fe1c7f992ffbbf5

    SHA512

    91d8b92f4bec627d87dd1dfa86e513d2820bebf2a60e8e9c793e038d3e9e417f7dd23b283599053d32e4b6fe1e13caf9139286b3c3185659ae3f166fbc037b73

    Download Submit

  • /data/user/0/race.alien.cave/app_DynamicOptDex/BP.json
    Filesize

    695KB

    MD5

    4afc7054bb8fee539b64e2dca2474788

    SHA1

    64dfc27445d7d0a85aef17c59bf35ab8322118aa

    SHA256

    59c76695c2bff78139aa6987724ce5c6d16ab1d30d3b334498c89cb124bae5ee

    SHA512

    5c8feda7664e5e8104f1401917bdbed8edd79b3d8b71c2a189673a85188b9b4b87d4cb48500caee8d224b0649034a6e553a04b0cc9210763d0c066c0ad58afcb

    Download Submit