Analysis
-
max time kernel
144s -
max time network
136s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
29-02-2024 10:50
General
-
Target
ae558d6f0465295f8f01d58c3ab7fe21.apk
-
Size
3.8MB
-
MD5
ae558d6f0465295f8f01d58c3ab7fe21
-
SHA1
67e9336c1d0883fc627edcadb9507747d700b136
-
SHA256
fc226b880cbc3e7708265d3e9c4e75cc2c115be2a05afcdc17212e4a11ba2bc3
-
SHA512
be2072bedc843d257db5a7ed431e245fef9ff2797f07b8a2a730ccbe9ae5a1b47dea47c7500c9d2179f7a605081b14d5c446fe2fd81ff6f2d168a3181e1d4530
-
SSDEEP
98304:uLavM277jQZuwOiawrGKKGXppiJHbs0/iEd:uLkMi7jQZutD4RD06Ed
Malware Config
Extracted
alienbot
http://mamarhelindal1.digital
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
race.alien.cave1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
695KB
MD5ebc67699981cdbc76946f5d7bc199aa7
SHA1925105bdb9ac67f9354a7293e9bc756969fc4284
SHA256f5e52d984d6d894a2cc5b1fc827c659a1d0a6e1b69fa3c8326befe82a2b30fc1
SHA512966fc553d33efb2440765d30420d361df1f5c4965e3edaae91e1ea769001afd2a85995f008bd241f611bccca90f81917b1a1235b1a13182c208a62455dc30174
-
Filesize
695KB
MD564ea1fb6ccd0d453e7d5902e4e6aac83
SHA1d6de9e1a1cd1f2d9cf9a572aae2019bc2051fdf0
SHA2565de04cdf67628b192d348975d0bf33f2e89cc3855414a4286fe1c7f992ffbbf5
SHA51291d8b92f4bec627d87dd1dfa86e513d2820bebf2a60e8e9c793e038d3e9e417f7dd23b283599053d32e4b6fe1e13caf9139286b3c3185659ae3f166fbc037b73
-
Filesize
388B
MD59afaff24c76232e8ee87ee1b6d1628a6
SHA1a17005c5ea8b43157322b104b5e057cafebb9112
SHA256c65d2600114004dd600c053cc778c441dc8ba021efef72930954ff98be9b2077
SHA5121dc60a8152e185934bc2e4f852b570cb4b0f73075dd20a026e288907cd430fcf39af35afe469f370708a7b689af333b7d7e60439d31e7fd0c1309c1784fc0df1