Analysis
-
max time kernel
155s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
14-03-2024 19:12
General
-
Target
c964e7894329592360aff35b7b23205e.apk
-
Size
4.1MB
-
MD5
c964e7894329592360aff35b7b23205e
-
SHA1
cfecbbb47621aae31c38dd3627731362faf1638b
-
SHA256
e3242bbd0a14045280fe57c7eca7c16a332a79edf58662c3e4ffa825bf78568c
-
SHA512
439c8bc169dac94fedb73c2e8c77c09d6cd0848765ec6ebe41fb49464ce6b48c1c3dee7c925da34c2b91a39604b0365eddba8fe60cf5946c0bd7128e51f30bf0
-
SSDEEP
98304:GVPE9wlCb8u8aYe/l5awpIK9bRjrimV9uCQeNGxmhdLp:GVPE9WCbx8azlsm1cs9UeNjdl
Malware Config
Extracted
alienbot
http://vaydemenescomeres.net
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
damage.found.shrug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329B
MD5e0fb44e708cf0e5d52b3e867a5516842
SHA14901169132c4d979eb29c16ab86e6c696e22d807
SHA256d2ac6fd3e8db512f8ca295eb12b4ac036367e2302080bf39baa4dd121ecb1c59
SHA51200f2634ca3727f475159ac28b12c553007dd0b9f3b6c6f49e3d31b7da4d07e0461b2d934ed7315a503ffd465055219f6a985979b8ebabc5df4d7a16cf59bd27a
-
Filesize
682KB
MD55f8a4837f4def1b09b0f188673123d22
SHA11e3920332d14db0c60f8e86c9351505d4a1331e0
SHA256dbf46ae64f71b721f836f9c226449b40668031971524f1fc3120794c9fc2e67e
SHA51200394441aeb7109d38d67b26920d5931c17a5f19fcc9e56a5c016bce5c8d753c7b713b92774c09d676e2f1f24e1ef0bf7275a768178a5b2be69bc82b0debf52e
-
Filesize
682KB
MD5d0cc1d856bc60542ac6bbd8b52f219ba
SHA142e30dadf7bbb78e547e412278b51f8803a039e6
SHA25615c592305a47f5711e95708cd693b06ad287e2bb554a1ea27035aadba26af0db
SHA512bf7398b9fd56f374959b26a9f3aece8c951839f159ea92cd244cefbf064dce3bd722777697d87f55da6e2c703289a30cc8b6f2e90432af207c10829ab91f53bd