Analysis
-
max time kernel
144s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
01-03-2024 22:03
General
-
Target
55f3a36224014e7365675ecea86cc292ce1bb0c2fe06b8099c756e8b3eb0f25f.apk
-
Size
1.4MB
-
MD5
f7e36904feb82a0970e0633016d3294d
-
SHA1
7ac8f89a6264f67f00c53861fdb7ffa617741e03
-
SHA256
55f3a36224014e7365675ecea86cc292ce1bb0c2fe06b8099c756e8b3eb0f25f
-
SHA512
fbcdeb2194b05dbed54338d970c6093439a7be1b3a3ca28688d8772c28b93032880baf1bc92b477b6ec4e641494ebb482fb1380e1df40e3063107af12163c421
-
SSDEEP
24576:omb41KvpmtfFsvn+oeYoP4I4wKu82Qvbbkvpm8JaYQQ6OZ5nSyHfIaAoTU:xcw2gn+R+I4wKvgMiatg5nPJAoTU
Malware Config
Extracted
alienbot
http://botduke1.ug
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/oat/x86/Ab.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD55c8571c828c3032ac51dfd8d1f611d72
SHA1d71631447f7bebcc3918029b049e404095d923b2
SHA25612e94b15bb89b048c85dca877ca79cf8311a2a3a9a734d38f529e02030917805
SHA512f53ac0aab40d57bac59888347920df2dc39ecb9c3c383ed5c3e8454d8834f684e53d5b8c00ce132e1b2f60784eae85e685854c094e3f682acf508f7b2585bfe5
-
Filesize
273KB
MD5cbb32307586f83d070bb84ad6c26dd73
SHA125b3d36d28c2f4fef6c77db8bdfe8e9b1b970657
SHA256523903298635824a4ac430a3345a0dd2db0c38e3fc97f05d4242e16ecddca561
SHA512a658ffb262ecca2e18b77f15ebd14fd614c522d586945863fde5d6c84fa8a796c7966d5dd7e41fce7399ee1a38711a7e79e869106d064fddc218971d6c4eb11d
-
Filesize
343B
MD512a56d4f9e7b2cc7636bf257f91abbae
SHA17674e6567fd8fdafc7904991b8f3d783ca2526f1
SHA256c636a9ef86bbb9bf19faeba1621c26bd9159a1ddf04dfee2aa5f28f5aac002f2
SHA51203e1cddda4992f031d20a97df657225ef19b3a644e2a69256c34421b9c88fb3e6409af55b73625cf7dffd32c6b74eef88df0bd6fe38fc07dbbca7253051802de
-
Filesize
273KB
MD51816f834fe5d8dc1e35c093f9fa77ffa
SHA1d63332f466bd7e79664e89aa12dce17066d19c1c
SHA25600a0947efbd4a03a30cccd56fc1233352eab7277841031ad949acb7011e5c257
SHA512a4d214682d4f63c963ed4a9e7d2f974daaaac83b0f869ee23e62ce8a9b507ec365a4b87abbfc2afe584b18fb763685ae1ddbbeec8ea9a32d3162b235cf059857