Analysis
-
max time kernel
159s -
max time network
151s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
29-02-2024 10:50
General
-
Target
ae558d6f0465295f8f01d58c3ab7fe21.apk
-
Size
3.8MB
-
MD5
ae558d6f0465295f8f01d58c3ab7fe21
-
SHA1
67e9336c1d0883fc627edcadb9507747d700b136
-
SHA256
fc226b880cbc3e7708265d3e9c4e75cc2c115be2a05afcdc17212e4a11ba2bc3
-
SHA512
be2072bedc843d257db5a7ed431e245fef9ff2797f07b8a2a730ccbe9ae5a1b47dea47c7500c9d2179f7a605081b14d5c446fe2fd81ff6f2d168a3181e1d4530
-
SSDEEP
98304:uLavM277jQZuwOiawrGKKGXppiJHbs0/iEd:uLkMi7jQZutD4RD06Ed
Malware Config
Extracted
alienbot
http://mamarhelindal1.digital
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 8 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
race.alien.cave1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
695KB
MD5ebc67699981cdbc76946f5d7bc199aa7
SHA1925105bdb9ac67f9354a7293e9bc756969fc4284
SHA256f5e52d984d6d894a2cc5b1fc827c659a1d0a6e1b69fa3c8326befe82a2b30fc1
SHA512966fc553d33efb2440765d30420d361df1f5c4965e3edaae91e1ea769001afd2a85995f008bd241f611bccca90f81917b1a1235b1a13182c208a62455dc30174
-
Filesize
695KB
MD564ea1fb6ccd0d453e7d5902e4e6aac83
SHA1d6de9e1a1cd1f2d9cf9a572aae2019bc2051fdf0
SHA2565de04cdf67628b192d348975d0bf33f2e89cc3855414a4286fe1c7f992ffbbf5
SHA51291d8b92f4bec627d87dd1dfa86e513d2820bebf2a60e8e9c793e038d3e9e417f7dd23b283599053d32e4b6fe1e13caf9139286b3c3185659ae3f166fbc037b73
-
Filesize
330B
MD56d0cab7e531553f9dad41a541f7609b9
SHA18d0308cd792aa64aca9fc3e1d4bcc5cb11deddb7
SHA25663db2ba33030b9b81ba331fdab3030264638b6407b23289379581c6c9dbfc5c8
SHA512e67ef583949a1d9cba5f6f21c0c6c86f9a0312b7636c21611a7bb08c591023fcbc005ccb04100ce1518c6b1a68ed6a986292992fa536c809ae8ed94f1cc1e2b5