Analysis
-
max time kernel
144s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
10-03-2024 07:36
General
-
Target
be0a0e5e44bfd1f88aacc9759eecb33f.apk
-
Size
3.2MB
-
MD5
be0a0e5e44bfd1f88aacc9759eecb33f
-
SHA1
115a112ab7ba770606b5a6dd64285351e578f189
-
SHA256
06cd6615089297c72da04561ffd8c65676304aba74d684ab0559159effbabf4f
-
SHA512
f282934eeb74b318d484d75c30e43c71d1296d914370c311f390fb9e095055a7de9f5eacc0955e542cb797595e87125a812d15e076731b975dbc307d6833f7ea
-
SSDEEP
49152:ADaiTrDeqky92+PpHiRuNEAaTvAz+dF7xxVQOoz/3sUJuzeaV3V1SAMLKCDNnC+v:ofeqF97A9TICdFlxOP5gt8LtNxdfD
Malware Config
Extracted
alienbot
http://34.89.151.222
Extracted
alienbot
http://34.89.151.222
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
auction.ceiling.spoon1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449KB
MD5d9f93437eb1920ef56546e2c2c84d158
SHA143f0083c212433741821b1745ce7401533836e06
SHA2561135ce97bf3cb45b66f4f0c78b05f525c8f8a38cf7ee4f25c885931ea8d354f4
SHA5126e91bd0aab921a895a6a19d7f71df1fd17a4b05c563558b143c9ad17a606b62a2c7621fef079a2e319f41166f6686106b8c0d7b2bfdff5ba65f830b0d40e498d
-
Filesize
426B
MD599f974756edbde4c63358c4b46723e63
SHA16bedc3ebd4e6139f6e507402c3dcc2216cea4004
SHA2565cfe82dc9098015d87acdf8e343eaf289a405101b5971ede88f93aba9884b472
SHA512c9328ed9f763effa3e3d14cc343248f0845866cf5bdafd210a609abd5d3cb7de8896577563a3394826a22015d3842624f68c50fdf78b34329176946e4b0d996a
-
Filesize
670KB
MD59c18581d01b308a8da8ba6b1e677ff3f
SHA19b83a91d841d0dc639e8d2976193cd9ef066a353
SHA256f9a52e2fa64d30169708a3a9981bdb911342b34a1f9ce1e73f2ef33426ce1495
SHA51293d3b5ca33bfaa55f006de69a64f0c0f27c861b83a3172ada5a687ddacfac82c3b6874c366215fce4436a673548bc16e118686f9e42928c9854a880b19a131f7