Analysis
-
max time kernel
148s -
max time network
141s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
14-03-2024 19:12
General
-
Target
c964e7894329592360aff35b7b23205e.apk
-
Size
4.1MB
-
MD5
c964e7894329592360aff35b7b23205e
-
SHA1
cfecbbb47621aae31c38dd3627731362faf1638b
-
SHA256
e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c
-
SHA512
439c8bc169dac94fedb73c2e8c77c09d6cd0848765ec6ebe41fb49464ce6b48c1c3dee7c925da34c2b91a39604b0365eddba8fe60cf5946c0bd7128e51f30bf0
-
SSDEEP
98304:GVPE9wlCb8u8aYe/l5awpIK9bRjrimV9uCQeNGxmhdLp:GVPE9WCbx8azlsm1cs9UeNjdl
Malware Config
Extracted
alienbot
http://vaydemenescomeres.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
damage.found.shrug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
407B
MD5af0264fbbd1206aad37eb8ab99124e08
SHA110a52d8ae1a165e4936848ea2e66547d6db0754c
SHA256b8d34d5908f49ff19161e2636c434d2e34e7e8b1369b76371c13ffd765e6dc44
SHA512e780532d2673e7d01899b8554977f5e20924a410f45cffc98b994b0cc5369553d2f282b318b80774fed93c1fda870475fa00fe999d192c94ce2bd7ff5ed2fd63
-
Filesize
682KB
MD55f8a4837f4def1b09b0f188673123d22
SHA11e3920332d14db0c60f8e86c9351505d4a1331e0
SHA256dbf46ae64f71b721f836f9c226449b40668031971524f1fc3120794c9fc2e67e
SHA51200394441aeb7109d38d67b26920d5931c17a5f19fcc9e56a5c016bce5c8d753c7b713b92774c09d676e2f1f24e1ef0bf7275a768178a5b2be69bc82b0debf52e
-
Filesize
682KB
MD5d0cc1d856bc60542ac6bbd8b52f219ba
SHA142e30dadf7bbb78e547e412278b51f8803a039e6
SHA25615c592305a47f5711e95708cd693b06ad287e2bb554a1ea27035aadba26af0db
SHA512bf7398b9fd56f374959b26a9f3aece8c951839f159ea92cd244cefbf064dce3bd722777697d87f55da6e2c703289a30cc8b6f2e90432af207c10829ab91f53bd