Analysis
-
max time kernel
139s -
max time network
149s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
14-03-2024 19:12
General
-
Target
c964e7894329592360aff35b7b23205e.apk
-
Size
4.1MB
-
MD5
c964e7894329592360aff35b7b23205e
-
SHA1
cfecbbb47621aae31c38dd3627731362faf1638b
-
SHA256
e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c
-
SHA512
439c8bc169dac94fedb73c2e8c77c09d6cd0848765ec6ebe41fb49464ce6b48c1c3dee7c925da34c2b91a39604b0365eddba8fe60cf5946c0bd7128e51f30bf0
-
SSDEEP
98304:GVPE9wlCb8u8aYe/l5awpIK9bRjrimV9uCQeNGxmhdLp:GVPE9WCbx8azlsm1cs9UeNjdl
Malware Config
Extracted
alienbot
http://vaydemenescomeres.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes
-
damage.found.shrug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457B
MD549a0c47bbc22567d57a7838dcda725a2
SHA13026eb961aa90d4083757a83c5a34523ca8f2b90
SHA256d0d0f4ef3fc6a9ece903fa9d27d704fbafac6bf4eff21777b73e31f078ecacbb
SHA512f86b04bc6a6a7ce017191ad04c7534291373a08339b831ab935f640b92966c244022ee6d5c7666114ac11d7d0a0655e19a7a945c1d1022025b48e0db4b06ff68
-
Filesize
682KB
MD55f8a4837f4def1b09b0f188673123d22
SHA11e3920332d14db0c60f8e86c9351505d4a1331e0
SHA256dbf46ae64f71b721f836f9c226449b40668031971524f1fc3120794c9fc2e67e
SHA51200394441aeb7109d38d67b26920d5931c17a5f19fcc9e56a5c016bce5c8d753c7b713b92774c09d676e2f1f24e1ef0bf7275a768178a5b2be69bc82b0debf52e
-
Filesize
682KB
MD5d0cc1d856bc60542ac6bbd8b52f219ba
SHA142e30dadf7bbb78e547e412278b51f8803a039e6
SHA25615c592305a47f5711e95708cd693b06ad287e2bb554a1ea27035aadba26af0db
SHA512bf7398b9fd56f374959b26a9f3aece8c951839f159ea92cd244cefbf064dce3bd722777697d87f55da6e2c703289a30cc8b6f2e90432af207c10829ab91f53bd