Analysis
-
max time kernel
136s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
01-03-2024 22:03
General
-
Target
55f3a36224014e7365675ecea86cc292ce1bb0c2fe06b8099c756e8b3eb0f25f.apk
-
Size
1.4MB
-
MD5
f7e36904feb82a0970e0633016d3294d
-
SHA1
7ac8f89a6264f67f00c53861fdb7ffa617741e03
-
SHA256
55f3a36224014e7365675ecea86cc292ce1bb0c2fe06b8099c756e8b3eb0f25f
-
SHA512
fbcdeb2194b05dbed54338d970c6093439a7be1b3a3ca28688d8772c28b93032880baf1bc92b477b6ec4e641494ebb482fb1380e1df40e3063107af12163c421
-
SSDEEP
24576:omb41KvpmtfFsvn+oeYoP4I4wKu82Qvbbkvpm8JaYQQ6OZ5nSyHfIaAoTU:xcw2gn+R+I4wKvgMiatg5nPJAoTU
Malware Config
Extracted
alienbot
http://botduke1.ug
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD55c8571c828c3032ac51dfd8d1f611d72
SHA1d71631447f7bebcc3918029b049e404095d923b2
SHA25612e94b15bb89b048c85dca877ca79cf8311a2a3a9a734d38f529e02030917805
SHA512f53ac0aab40d57bac59888347920df2dc39ecb9c3c383ed5c3e8454d8834f684e53d5b8c00ce132e1b2f60784eae85e685854c094e3f682acf508f7b2585bfe5
-
Filesize
273KB
MD5cbb32307586f83d070bb84ad6c26dd73
SHA125b3d36d28c2f4fef6c77db8bdfe8e9b1b970657
SHA256523903298635824a4ac430a3345a0dd2db0c38e3fc97f05d4242e16ecddca561
SHA512a658ffb262ecca2e18b77f15ebd14fd614c522d586945863fde5d6c84fa8a796c7966d5dd7e41fce7399ee1a38711a7e79e869106d064fddc218971d6c4eb11d
-
Filesize
358B
MD56ef9e5b115e63c755b20724d6958cef7
SHA15b2f1e2fe4bc46a38d7254be5c43077826f99c91
SHA25684cc0aa64c3ef26ae01d633d7b70741741b3361eeb69a44c8075cbfb1a28316a
SHA512ce1e233e8d3805c83ad76e4e40e74d79d50f6cffc58454fc9d286ddde8b7ce47c15eca3199ea314ed22a34b6ad1d9b6f6b3472e55a677141a5ac187189ab4200
-
Filesize
222KB
MD54d0cc3dc9c7b888964dead7cbb80431d
SHA195bd46a6266b8eef9510b89deab0a19823b5a132
SHA25688991572b7c43bfedc3d9a39674f9c9a62e1f9a85f1e0f5dec3bb65d82d51b04
SHA512aeaef6271f924b2ffd7e996b2fba5dfeb03d8c3dcb17e546b659ace968e4f69d0e0960b5402e4d1d96041c54eb040b23490f1c8f161c1f1066d425cd1c939d59