Overview

overview

10

Static

static

6

ea4960b847...4d.apk

android-9-x86

10

ea4960b847...4d.apk

android-10-x64

10

ea4960b847...4d.apk

android-11-x64

10

Analysis

  • max time kernel
    65s
  • max time network
    67s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    15-03-2024 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d.apk

  • Size

    1.7MB

  • MD5

    69663d2b344d5872d0a3ccc6f8fa7cd9

  • SHA1

    3455a39c90775beaf6690d1b27b983bac2303389

  • SHA256

    ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d

  • SHA512

    d4eb5c6d7d9300572a638c60146a96b0f3eae271caef09eccb6b20bd94836f27d825a74f933991442cfac065ed270ca65be9a00bcb077a8ece8ce7fc2fcd0bbd

  • SSDEEP

    24576:ApPSssmK3/OmSX5N5O0gA3Kw7RDnnZLCLd080T9lj8b1BzuGY3HHDzfOTboEJeHZ:AhSswjq5S0DKw7RDZG73BJuGA0J2cwZ

Score
10/10
alienbotcerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://185.255.131.145

rc4.plain

Extracted

Family

alienbot

C2

http://185.255.131.145

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Requests enabling of the accessibility settings. 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.degree.enough
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4281
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.degree.enough/app_DynamicOptDex/YBIw.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.degree.enough/app_DynamicOptDex/oat/x86/YBIw.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4306

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.degree.enough/app_DynamicOptDex/YBIw.json
    Filesize

    238KB

    MD5

    9f98da53fb6d83c57afb7446cd53957c

    SHA1

    f69335516034e3098a9c86e05f9afba31035d922

    SHA256

    85bb1345a96b0b54c9090b9634ef02f8cfb7e5298b60bdf077849d570ec3c342

    SHA512

    71c48b45d08ad67835ba5b76c7c4597d821302deeb8ac50b84fc5f77d2a01f5c4f7eb43e633622e1473007a95a5223fe6719802e7adbc7d3d7ad77e1b07a48e0

    Download Submit

  • /data/data/com.degree.enough/app_DynamicOptDex/YBIw.json
    Filesize

    238KB

    MD5

    1a129259ffec5e09ebb8a728163b4db5

    SHA1

    0340299929b8f0325bda1523593f6c1c292f1651

    SHA256

    603fcae1ef4062087e0e09aa377c03fcc8bbd6f3db443717957f1bfe8c4a4dae

    SHA512

    59ac6a734fbf21c6c366309e61b143d7b08aa658bff150a600a9636faef9ee99240a899f682eb592e7ed9c69883d61d3e050fa4fa3613da0315be8a72988d410

    Download Submit

  • /data/user/0/com.degree.enough/app_DynamicOptDex/YBIw.json
    Filesize

    483KB

    MD5

    783e2921cd191afae51fcf256a0f17ed

    SHA1

    57c778b375a4b216dd0c15cc9ea3511396d9fe09

    SHA256

    940ef722fa3a6fee507e9f65893ac29b3e89d594e1a370eca3773bde3f07a322

    SHA512

    9fc70ad0f41c5866fb4856b5fd7b3e23c6c79bc57744a007b49b33d935f2740a3e8d974cd323ace426c5a42aa96aaabd6953e1e02de8284b30d3084dab6134dc

    Download Submit

  • /data/user/0/com.degree.enough/app_DynamicOptDex/YBIw.json
    Filesize

    483KB

    MD5

    ac61532c592fd2972f53ae87e7e8b9d0

    SHA1

    e308837c963cbb7ceb1fb450a0d11731b36f763a

    SHA256

    d6eeb51627eb2995f65f584ed335b1c85247c26166e256e59c0cc2ee7ba92ddd

    SHA512

    aac42ea78578acd66a550a62d3faf97f5b8de9854a7a23ecf9dd0c16b96c55d37e4741a87e8e07874c1a7368c8b2094f56c8fb276536666b8693e7d666fe2b7c

    Download Submit