Overview

overview

10

Static

static

6

ea4960b847...4d.apk

android-9-x86

10

ea4960b847...4d.apk

android-10-x64

10

ea4960b847...4d.apk

android-11-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    63s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    15-03-2024 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d.apk

  • Size

    1.7MB

  • MD5

    69663d2b344d5872d0a3ccc6f8fa7cd9

  • SHA1

    3455a39c90775beaf6690d1b27b983bac2303389

  • SHA256

    ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d

  • SHA512

    d4eb5c6d7d9300572a638c60146a96b0f3eae271caef09eccb6b20bd94836f27d825a74f933991442cfac065ed270ca65be9a00bcb077a8ece8ce7fc2fcd0bbd

  • SSDEEP

    24576:ApPSssmK3/OmSX5N5O0gA3Kw7RDnnZLCLd080T9lj8b1BzuGY3HHDzfOTboEJeHZ:AhSswjq5S0DKw7RDZG73BJuGA0J2cwZ

Score
10/10
alienbotcerberusbankercollectionevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://185.255.131.145

rc4.plain

Extracted

Family

alienbot

C2

http://185.255.131.145

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 3 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.degree.enough
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4431

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.degree.enough/app_DynamicOptDex/YBIw.json
    Filesize

    483KB

    MD5

    ac61532c592fd2972f53ae87e7e8b9d0

    SHA1

    e308837c963cbb7ceb1fb450a0d11731b36f763a

    SHA256

    d6eeb51627eb2995f65f584ed335b1c85247c26166e256e59c0cc2ee7ba92ddd

    SHA512

    aac42ea78578acd66a550a62d3faf97f5b8de9854a7a23ecf9dd0c16b96c55d37e4741a87e8e07874c1a7368c8b2094f56c8fb276536666b8693e7d666fe2b7c

    Download Submit
  • /data/user/0/com.degree.enough/app_DynamicOptDex/oat/YBIw.json.cur.prof
    Filesize

    325B

    MD5

    81e33ba1554ccfae1727184d2002d406

    SHA1

    12e70dff654211330ed40e55e8ac3bc833c460c3

    SHA256

    550f0e7fb89a33b54fcb0444c74192249eaf1267faf766d27d5858bab10653c6

    SHA512

    c9744bfec2abb7d92b3aa15566b95022b52e7de5ead448ec243fac34f55c0534019b792d0b2509f48a771feb2eed568a11756c4b4e3644cb89fd1064d3245f9b

    Download Submit