Analysis
-
max time kernel
152s -
max time network
139s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
20-03-2024 12:38
General
-
Target
d8d350a851b553a6b02a952a0307b7eb.apk
-
Size
3.3MB
-
MD5
d8d350a851b553a6b02a952a0307b7eb
-
SHA1
8c3485192bb7bbaf00ba942097067de1696d7a97
-
SHA256
f7a2065371c494fe901131fc41ecd11895f34f0ebf7bb41512b0972c92784dbe
-
SHA512
19b9d46ac9aab48c002c5853a6b13e8f427edd7cda492fe5834d6704b3d72368a09354e9c6b9212d2221556bde76d465d5f088f8bfff4b1164979413afbb8eb7
-
SSDEEP
49152:pBuGlUYQH6KLIjknS752gSytBS8BHTh+9fAeWFBe9tt/15OCewLVbUFJPGmkAprS:nfQHHu75PftbZSoeWF4ZNUf+mkA3Y
Malware Config
Extracted
alienbot
https://instagrambuyukprofil.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
assist.citizen.loud1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
713KB
MD5f4c728452607be8324e1a9ed65a99362
SHA1b4c2c97dc0b462431ad249c2efb4d80c11d12cd7
SHA25654cc13809370a0e33039ef731c144024002c7f556cf18922c942111ccfa864b4
SHA512ffc78dabc559838fb83f81124d91faf5a434bc651866e32d0affad61ea83cdff1347d4ac1d14443cb04a37278971283067085d46be869870b710eafb7fc5cfd9
-
Filesize
257KB
MD5c54228f3bbb0de94a6c999765f5d72aa
SHA1981bbd31e1216e42eccba157584cbcd0e2a968b0
SHA256a5c9055e4c9cbc28579ae0f9a3b44ecd6a889f26f15d79ed65667c1a6a799bfa
SHA512c92a5ab2e50029597ea83252aee83bc21f84e0f2d2421a52b51c43640b43d7f3eab95b0cab56bfce997c8755c8e35622f49a29f597addc232432066876d1ce96
-
Filesize
495B
MD51152b8fea7b37db798338949e0f66cf3
SHA1d2ea69365b4af74e17890b079df1ebfd06a7c3f0
SHA256cac8eaae40ae9b6216a4f238891fa8b0d1122b1a50ad5595870a8706608a1aa4
SHA51283e87f7b2135aae66b7f412de452005c6457cced8958b058d258391dc512ed6e212e20b03700b1b2cc3d3e332bc629d0b4a1c3791502488c5c28c88abf49e065
-
Filesize
713KB
MD56eed178a6e26f94495ab872104f3cf38
SHA1b5bdc8ab06fca690e5fabc574b90830b5aaee264
SHA25692bda9528a229e08f62d15a55b516d2385947a240711c7b6e69bdce712dae9e1
SHA512c25dc28635ee3f11dc0d181b7b8491cfff0f1239a84922c60c0f2c7a118415df176671b4eb3b108f193371f4010e28d7a6d3ae05e7e954ceb584fcede185a525