Analysis
-
max time kernel
67s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
10-03-2024 22:04
General
-
Target
2a7d04d1b38b24178a60bc0b68758630e0cb118823d4bfcbe97f36aff59331a2.apk
-
Size
953KB
-
MD5
34ef5ac3e6b35bd49cb43ce78a09c048
-
SHA1
fbd4f305b6c7534407214ee2d63682475d00201b
-
SHA256
2a7d04d1b38b24178a60bc0b68758630e0cb118823d4bfcbe97f36aff59331a2
-
SHA512
7fe1575b9365ac6d246412ba4e7bc1301223ddebbd184c95153894eb4808e44b5fe54abe67ae938e7e924e78092dd4fb8efcfe892e21db351b680ed8b760ccb6
-
SSDEEP
24576:UHpIk0a9cjvVuVc4TVtn/EP9ePIsDyZkB3/K5Pv:UJ3uv6nVtn09egTPv
Malware Config
Extracted
alienbot
http://mynewpath.top
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
scissors.boss.wide1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
438KB
MD57fd00caac8a2e341f01d91cf4df827fc
SHA1c6e2327ec45f165314bfd618d1a33efb410037fb
SHA2565b7733327d0b6d093116265ca251741396d77bf1527e418f0f02d7271a24ba59
SHA5121c6205dff0d99b533f2d39f6f78d270d187eae76a4db31b0f1a193a3dcb847772f09cf35a688830046bd0967aebd7b7a5ee9a9bac3e56a2755398820e1b49458
-
Filesize
438KB
MD54838b9bf720dc8d2c0a4141242d6bffa
SHA147a5073870509924143fc19f44d8f757700d46ab
SHA256f729355e23354dd7beaa653e881f29ad87506eb2bfcd66ea14e585919eecc997
SHA512c09f6f324044ce2f33d711732bcd20059f6444e7186f321a00d95f93194f199ba728e84682bebc5c933ac8a164576fc97fa732855183068f5ea758541cb640bb
-
Filesize
202B
MD544ed36f2386b55f1ecb33d0854d832d2
SHA17beceb82a0d3aed1113f1ddad0de7bdfd9978472
SHA2569202247e64ea92561d9babfc389ea94346b95db941a9f2aff039906f7de40b8e
SHA51213a5e0068dc5fb3fe939048045997f6f67c0f9bab1e5ff509dc325b39fabab25ab1dd98c3ba56ede776f6630c96e6283331f12cbb6f6b08de4d5176de344e6de