Analysis
-
max time kernel
59s -
max time network
63s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
15-03-2024 11:43
General
-
Target
ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d.apk
-
Size
1.7MB
-
MD5
69663d2b344d5872d0a3ccc6f8fa7cd9
-
SHA1
3455a39c90775beaf6690d1b27b983bac2303389
-
SHA256
ea4960b84756fd82fe43cb2cffdbe464df6dd4d48aa10d1cefe38aa8ac6eb44d
-
SHA512
d4eb5c6d7d9300572a638c60146a96b0f3eae271caef09eccb6b20bd94836f27d825a74f933991442cfac065ed270ca65be9a00bcb077a8ece8ce7fc2fcd0bbd
-
SSDEEP
24576:ApPSssmK3/OmSX5N5O0gA3Kw7RDnnZLCLd080T9lj8b1BzuGY3HHDzfOTboEJeHZ:AhSswjq5S0DKw7RDZG73BJuGA0J2cwZ
Malware Config
Extracted
alienbot
http://185.255.131.145
Extracted
alienbot
http://185.255.131.145
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.degree.enough1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
483KB
MD5ac61532c592fd2972f53ae87e7e8b9d0
SHA1e308837c963cbb7ceb1fb450a0d11731b36f763a
SHA256d6eeb51627eb2995f65f584ed335b1c85247c26166e256e59c0cc2ee7ba92ddd
SHA512aac42ea78578acd66a550a62d3faf97f5b8de9854a7a23ecf9dd0c16b96c55d37e4741a87e8e07874c1a7368c8b2094f56c8fb276536666b8693e7d666fe2b7c
-
Filesize
325B
MD581e33ba1554ccfae1727184d2002d406
SHA112e70dff654211330ed40e55e8ac3bc833c460c3
SHA256550f0e7fb89a33b54fcb0444c74192249eaf1267faf766d27d5858bab10653c6
SHA512c9744bfec2abb7d92b3aa15566b95022b52e7de5ead448ec243fac34f55c0534019b792d0b2509f48a771feb2eed568a11756c4b4e3644cb89fd1064d3245f9b