Analysis
-
max time kernel
155s -
max time network
151s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
10-03-2024 07:36
General
-
Target
be0a0e5e44bfd1f88aacc9759eecb33f.apk
-
Size
3.2MB
-
MD5
be0a0e5e44bfd1f88aacc9759eecb33f
-
SHA1
115a112ab7ba770606b5a6dd64285351e578f189
-
SHA256
06cd6615089297c72da04561ffd8c65676304aba74d684ab0559159effbabf4f
-
SHA512
f282934eeb74b318d484d75c30e43c71d1296d914370c311f390fb9e095055a7de9f5eacc0955e542cb797595e87125a812d15e076731b975dbc307d6833f7ea
-
SSDEEP
49152:ADaiTrDeqky92+PpHiRuNEAaTvAz+dF7xxVQOoz/3sUJuzeaV3V1SAMLKCDNnC+v:ofeqF97A9TICdFlxOP5gt8LtNxdfD
Malware Config
Extracted
alienbot
http://34.89.151.222
Extracted
alienbot
http://34.89.151.222
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
auction.ceiling.spoon1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
670KB
MD5ebedab95542fc08b445756e0afddc575
SHA1a691154b27ed490ceabfd913bab4003f73e5679c
SHA256bed87cacadc30a3e1d54cd94440f9e3bf4243bf5e49939a742031feb6d5b8591
SHA512f19f930edb1238bc3012fdf65f48095a2b6ff92b0a81cf7df98c7dbbd980d84343d0e406c1e230ee1eae1efc2bd62d7ea24eb38a995f09a5336521140022b0f4
-
Filesize
670KB
MD59c18581d01b308a8da8ba6b1e677ff3f
SHA19b83a91d841d0dc639e8d2976193cd9ef066a353
SHA256f9a52e2fa64d30169708a3a9981bdb911342b34a1f9ce1e73f2ef33426ce1495
SHA51293d3b5ca33bfaa55f006de69a64f0c0f27c861b83a3172ada5a687ddacfac82c3b6874c366215fce4436a673548bc16e118686f9e42928c9854a880b19a131f7
-
Filesize
373B
MD5d854db872f8b962edeaa60c9b9db9fbe
SHA15914e55d3ec45fd7cd43dd77d16ea1392b030b2d
SHA25654cb95ab4c26a09f221822ea94ff2ea65e65286a9df20dc06c5ea08191fcb2df
SHA5123315c850ee64b769b5719a3da75f21b160e3748ea169ee681d1797be200b725d041d9cf04cfff977234fed6fb6ad6d1b6c042634b0142500bdca1ea36b485b0d