Analysis
-
max time kernel
54s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
10-03-2024 22:04
General
-
Target
2a7d04d1b38b24178a60bc0b68758630e0cb118823d4bfcbe97f36aff59331a2.apk
-
Size
953KB
-
MD5
34ef5ac3e6b35bd49cb43ce78a09c048
-
SHA1
fbd4f305b6c7534407214ee2d63682475d00201b
-
SHA256
2a7d04d1b38b24178a60bc0b68758630e0cb118823d4bfcbe97f36aff59331a2
-
SHA512
7fe1575b9365ac6d246412ba4e7bc1301223ddebbd184c95153894eb4808e44b5fe54abe67ae938e7e924e78092dd4fb8efcfe892e21db351b680ed8b760ccb6
-
SSDEEP
24576:UHpIk0a9cjvVuVc4TVtn/EP9ePIsDyZkB3/K5Pv:UJ3uv6nVtn09egTPv
Malware Config
Extracted
alienbot
http://mynewpath.top
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
scissors.boss.wide1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
438KB
MD57fd00caac8a2e341f01d91cf4df827fc
SHA1c6e2327ec45f165314bfd618d1a33efb410037fb
SHA2565b7733327d0b6d093116265ca251741396d77bf1527e418f0f02d7271a24ba59
SHA5121c6205dff0d99b533f2d39f6f78d270d187eae76a4db31b0f1a193a3dcb847772f09cf35a688830046bd0967aebd7b7a5ee9a9bac3e56a2755398820e1b49458
-
Filesize
438KB
MD54838b9bf720dc8d2c0a4141242d6bffa
SHA147a5073870509924143fc19f44d8f757700d46ab
SHA256f729355e23354dd7beaa653e881f29ad87506eb2bfcd66ea14e585919eecc997
SHA512c09f6f324044ce2f33d711732bcd20059f6444e7186f321a00d95f93194f199ba728e84682bebc5c933ac8a164576fc97fa732855183068f5ea758541cb640bb
-
Filesize
550B
MD5e555c8217bfc0506a033e0736f8511ed
SHA11b378774b29edf2b889a76ac07eff50aea9792d5
SHA2563a46fd5087de05c874020cff8a1aa7a265d525f6b3315672d5098564b3f3cd6e
SHA512a7a1b63b01bb2b1d04ecdd682497de83d145d84c75e763b82049f605509177c221853f55e55775332e2f91e97f78c46b158c18bf279e79ab9da7effe633cb833