Overview

overview

10

Static

static

6

c964e78943...5e.apk

android-9-x86

10

c964e78943...5e.apk

android-10-x64

10

c964e78943...5e.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c964e7894329592360aff35b7b23205e

  • Size

    4.1MB

  • Sample

    240314-xwy7vseg24

  • MD5

    c964e7894329592360aff35b7b23205e

  • SHA1

    cfecbbb47621aae31c38dd3627731362faf1638b

  • SHA256

    e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c

  • SHA512

    439c8bc169dac94fedb73c2e8c77c09d6cd0848765ec6ebe41fb49464ce6b48c1c3dee7c925da34c2b91a39604b0365eddba8fe60cf5946c0bd7128e51f30bf0

  • SSDEEP

    98304:GVPE9wlCb8u8aYe/l5awpIK9bRjrimV9uCQeNGxmhdLp:GVPE9WCbx8azlsm1cs9UeNjdl

Score
10/10
alienbotcerberusandroidbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://vaydemenescomeres.net

Targets

    • Target

      c964e7894329592360aff35b7b23205e

    • Size

      4.1MB

    • MD5

      c964e7894329592360aff35b7b23205e

    • SHA1

      cfecbbb47621aae31c38dd3627731362faf1638b

    • SHA256

      e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c

    • SHA512

      439c8bc169dac94fedb73c2e8c77c09d6cd0848765ec6ebe41fb49464ce6b48c1c3dee7c925da34c2b91a39604b0365eddba8fe60cf5946c0bd7128e51f30bf0

    • SSDEEP

      98304:GVPE9wlCb8u8aYe/l5awpIK9bRjrimV9uCQeNGxmhdLp:GVPE9WCbx8azlsm1cs9UeNjdl

    Score
    10/10
    alienbotcerberusbankercollectionevasioninfostealerratstealthtrojan

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

      bankertrojaninfostealeralienbot

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

      bankertrojaninfostealerevasionratcerberus

    • Cerberus payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks