Analysis
-
max time kernel
58s -
max time network
67s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
15-03-2024 11:43
General
-
Target
ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d.apk
-
Size
1.7MB
-
MD5
69663d2b344d5872d0a3ccc6f8fa7cd9
-
SHA1
3455a39c90775beaf6690d1b27b983bac2303389
-
SHA256
ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d
-
SHA512
d4eb5c6d7d9300572a638c60146a96b0f3eae271caef09eccb6b20bd94836f27d825a74f933991442cfac065ed270ca65be9a00bcb077a8ece8ce7fc2fcd0bbd
-
SSDEEP
24576:ApPSssmK3/OmSX5N5O0gA3Kw7RDnnZLCLd080T9lj8b1BzuGY3HHDzfOTboEJeHZ:AhSswjq5S0DKw7RDZG73BJuGA0J2cwZ
Malware Config
Extracted
alienbot
http://185.255.131.145
Extracted
alienbot
http://185.255.131.145
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
com.degree.enough1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD59f98da53fb6d83c57afb7446cd53957c
SHA1f69335516034e3098a9c86e05f9afba31035d922
SHA25685bb1345a96b0b54c9090b9634ef02f8cfb7e5298b60bdf077849d570ec3c342
SHA51271c48b45d08ad67835ba5b76c7c4597d821302deeb8ac50b84fc5f77d2a01f5c4f7eb43e633622e1473007a95a5223fe6719802e7adbc7d3d7ad77e1b07a48e0
-
Filesize
238KB
MD51a129259ffec5e09ebb8a728163b4db5
SHA10340299929b8f0325bda1523593f6c1c292f1651
SHA256603fcae1ef4062087e0e09aa377c03fcc8bbd6f3db443717957f1bfe8c4a4dae
SHA51259ac6a734fbf21c6c366309e61b143d7b08aa658bff150a600a9636faef9ee99240a899f682eb592e7ed9c69883d61d3e050fa4fa3613da0315be8a72988d410
-
Filesize
438B
MD5579e29865cbe658bec09feb626e7e078
SHA110653b054383e746c218ee57b132fbfa4a90880e
SHA2568a1253dd4c2eb5b11078f1e11a74d396e2a2d06e97fd2c42c54e2f261d86f5a4
SHA5124b63568f4909cbe771bf221cefb9f6da6278047c6967e0ae2cb5e106ce3bfd39fc1667686d808751282f924e0e5a4b6d3e419be8170afd21e641bbc05dddb221
-
Filesize
483KB
MD5ac61532c592fd2972f53ae87e7e8b9d0
SHA1e308837c963cbb7ceb1fb450a0d11731b36f763a
SHA256d6eeb51627eb2995f65f584ed335b1c85247c26166e256e59c0cc2ee7ba92ddd
SHA512aac42ea78578acd66a550a62d3faf97f5b8de9854a7a23ecf9dd0c16b96c55d37e4741a87e8e07874c1a7368c8b2094f56c8fb276536666b8693e7d666fe2b7c