Analysis
-
max time kernel
148s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
20-03-2024 12:38
General
-
Target
d8d350a851b553a6b02a952a0307b7eb.apk
-
Size
3.3MB
-
MD5
d8d350a851b553a6b02a952a0307b7eb
-
SHA1
8c3485192bb7bbaf00ba942097067de1696d7a97
-
SHA256
f7a2065371c494fe901131fc41ecd11895f34f0ebf7bb41512b0972c92784dbe
-
SHA512
19b9d46ac9aab48c002c5853a6b13e8f427edd7cda492fe5834d6704b3d72368a09354e9c6b9212d2221556bde76d465d5f088f8bfff4b1164979413afbb8eb7
-
SSDEEP
49152:pBuGlUYQH6KLIjknS752gSytBS8BHTh+9fAeWFBe9tt/15OCewLVbUFJPGmkAprS:nfQHHu75PftbZSoeWF4ZNUf+mkA3Y
Malware Config
Extracted
alienbot
https://instagrambuyukprofil.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
assist.citizen.loud1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
713KB
MD5f4c728452607be8324e1a9ed65a99362
SHA1b4c2c97dc0b462431ad249c2efb4d80c11d12cd7
SHA25654cc13809370a0e33039ef731c144024002c7f556cf18922c942111ccfa864b4
SHA512ffc78dabc559838fb83f81124d91faf5a434bc651866e32d0affad61ea83cdff1347d4ac1d14443cb04a37278971283067085d46be869870b710eafb7fc5cfd9
-
Filesize
713KB
MD56eed178a6e26f94495ab872104f3cf38
SHA1b5bdc8ab06fca690e5fabc574b90830b5aaee264
SHA25692bda9528a229e08f62d15a55b516d2385947a240711c7b6e69bdce712dae9e1
SHA512c25dc28635ee3f11dc0d181b7b8491cfff0f1239a84922c60c0f2c7a118415df176671b4eb3b108f193371f4010e28d7a6d3ae05e7e954ceb584fcede185a525
-
Filesize
369B
MD534eae3f83536c0a93969bc018ca6a6f6
SHA16308ab24add906418f890314b6dcd88300752226
SHA256e0bab0f8fe9db69eb919173f95e012bf6ddb36c18eb91658e722e9a52e2116ac
SHA512036e12fde09aae1d044d2934abe4cd36cd191a9e1b427567cba601e1d041c158a9e4fe31d3b1eefbe6e325dffd38726d7c996595eda8e5803c78996185b07a34