Analysis
-
max time kernel
140s -
max time network
153s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
01-03-2024 22:03
General
-
Target
55f3a36224014e7365675ecea86cc292ce1bb0c2fe06b8099c756e8b3eb0f25f.apk
-
Size
1.4MB
-
MD5
f7e36904feb82a0970e0633016d3294d
-
SHA1
7ac8f89a6264f67f00c53861fdb7ffa617741e03
-
SHA256
55f3a36224014e7365675ecea86cc292ce1bb0c2fe06b8099c756e8b3eb0f25f
-
SHA512
fbcdeb2194b05dbed54338d970c6093439a7be1b3a3ca28688d8772c28b93032880baf1bc92b477b6ec4e641494ebb482fb1380e1df40e3063107af12163c421
-
SSDEEP
24576:omb41KvpmtfFsvn+oeYoP4I4wKu82Qvbbkvpm8JaYQQ6OZ5nSyHfIaAoTU:xcw2gn+R+I4wKvgMiatg5nPJAoTU
Malware Config
Extracted
alienbot
http://botduke1.ug
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD55c8571c828c3032ac51dfd8d1f611d72
SHA1d71631447f7bebcc3918029b049e404095d923b2
SHA25612e94b15bb89b048c85dca877ca79cf8311a2a3a9a734d38f529e02030917805
SHA512f53ac0aab40d57bac59888347920df2dc39ecb9c3c383ed5c3e8454d8834f684e53d5b8c00ce132e1b2f60784eae85e685854c094e3f682acf508f7b2585bfe5
-
Filesize
273KB
MD5cbb32307586f83d070bb84ad6c26dd73
SHA125b3d36d28c2f4fef6c77db8bdfe8e9b1b970657
SHA256523903298635824a4ac430a3345a0dd2db0c38e3fc97f05d4242e16ecddca561
SHA512a658ffb262ecca2e18b77f15ebd14fd614c522d586945863fde5d6c84fa8a796c7966d5dd7e41fce7399ee1a38711a7e79e869106d064fddc218971d6c4eb11d
-
Filesize
206B
MD597202af802964237425473f0d96743cc
SHA1233303c151e778d0266ce97ee1614853e28700dc
SHA256d9d0d5192db8054d7f18e76d7e8f34f7bd5a9f0a61d4cc6e787fae28941440fc
SHA512ea7a57f6176a2fbf88e07141739f5ae7e5d9d1f7da3c8bfcf62f96c6c87c1effdb582aad28fc053fdeaf9824a32aab59cd05ad8efed1adb992e5259ec01bfdbe