Overview

overview

10

Static

static

6

90af468933...04.apk

android-9-x86

10

90af468933...04.apk

android-10-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    01-04-2024 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90af46893399b32b248d34e08ec642026a48477f248c5c3f6c43951eb66b9b04.apk

  • Size

    4.3MB

  • MD5

    ad917961fcd002cfac87b7f60c326b82

  • SHA1

    d2370a311205c367c06e84158995f9bc21c7291e

  • SHA256

    90af46893399b32b248d34e08ec642026a48477f248c5c3f6c43951eb66b9b04

  • SHA512

    1c622a6d3cbdab2febf3e70b763f72bec19a65598e8b302b297cbdd20916b22344738f50c87936eb33cc0b942c7fa921d0d386fc19dbf9d3eb4fc77f8d7b7243

  • SSDEEP

    98304:wOW+ZaAnVboJS4P/T/S9386jZ27hx1JNWjrVWn1wgvcxpr3aQ/:Hay0J6Stxkkn1wscXL/

Score
10/10
alienbotbankercollectionevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://wf4sctx9cksg94528o7o.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 1 TTPs 7 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion

Processes

  • com.fisherman.president
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4210
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.fisherman.president/app_DynamicOptDex/BssLvSYPdm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.fisherman.president/app_DynamicOptDex/oat/x86/BssLvSYPdm.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4237

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fisherman.president/app_DynamicOptDex/BssLvSYPdm.json
    Filesize

    704KB

    MD5

    f5248cd55e5af67bcfacf95943fe0b42

    SHA1

    924eef1eba3b88ef81ed52d79f5d60f00e2d081b

    SHA256

    8e8ad36bd2fde745196e568a786e58df96566e50701ae52f0a84ba36c1ea3e4d

    SHA512

    6000a4c3f4b9856286869c029441dec1dd8468aee52ac26cc58a66e9917f8435bac5ff1bc7b94039abdce9ee7f39742c91c96e9f8d5f31acd2613f8121a0cb01

    Download Submit

  • /data/data/com.fisherman.president/app_DynamicOptDex/BssLvSYPdm.json
    Filesize

    704KB

    MD5

    9854986904467590783cbb12c0844a3d

    SHA1

    3ac11f9a2a481c4e685a19945edeb1cf2d771c29

    SHA256

    e4641d8421990336fb34b1522994074c5aea4571c13c01b1bfa420c1b1ac5c90

    SHA512

    4e54b4fdf8b9932b974da7eae0205874ec4ba6aac4b8e95c366a5d9f73717485a3cf215019bfff7a6608baefcc6262728fdc5e797ab29b8b367d1db1c859aac4

    Download Submit

  • /data/data/com.fisherman.president/app_DynamicOptDex/oat/BssLvSYPdm.json.cur.prof
    Filesize

    1KB

    MD5

    178951af8cf2724fc1c3cbf41712b53d

    SHA1

    7e72963b01353591d61aad51de0352446ba944aa

    SHA256

    3f6c284344a1dc280c763a6fff290c6e03eaf6d290fb6806c7f622bf515129ed

    SHA512

    cb182c79a4f41b76aadf66880ff948c2fc8caff79e6486a58772157d064dfc2432ec8b89e4175a167f5909eecb679ec0581c6a650f45c0d5997bce2be0a412c1

    Download Submit

  • /data/user/0/com.fisherman.president/app_DynamicOptDex/BssLvSYPdm.json
    Filesize

    916KB

    MD5

    333039932cb8e0646a10f796183e38ab

    SHA1

    b4d86dfd96ffdde68feba0f3f820e33169a9358d

    SHA256

    bb17cfc071fac88dba13eb3b15c17ad3a5be8531e058368978c5217f43a5206b

    SHA512

    0b3595213ca658e5576afd30e5eeba534e3d8c7b50f50594c9c2181aa47399eb6a284407a7b25a217d18381d0d7fc34059743783b5781c49607ecc0ef9a26311

    Download Submit

  • /data/user/0/com.fisherman.president/app_DynamicOptDex/BssLvSYPdm.json
    Filesize

    916KB

    MD5

    15e86a48652302ef86fa822dea8702c1

    SHA1

    75d04228e1529f420659e4c8d91b5530e994679a

    SHA256

    859e258e53130e240adc699e9e1029624be728c3b12e63b1d9ffc8adf23c5197

    SHA512

    6984d31943134b073b7b9be3a444b1fd2faaecabe5df77e1806bd441660d91700c088b8dc4b7ccac632ca6aeb51877653a5806f53362fb70a2e65c79e507761f

    Download Submit