Analysis
-
max time kernel
154s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
01-04-2024 22:02
General
-
Target
90af46893399b32b248d34e08ec642026a48477f248c5c3f6c43951eb66b9b04.apk
-
Size
4.3MB
-
MD5
ad917961fcd002cfac87b7f60c326b82
-
SHA1
d2370a311205c367c06e84158995f9bc21c7291e
-
SHA256
90af46893399b32b248d34e08ec642026a48477f248c5c3f6c43951eb66b9b04
-
SHA512
1c622a6d3cbdab2febf3e70b763f72bec19a65598e8b302b297cbdd20916b22344738f50c87936eb33cc0b942c7fa921d0d386fc19dbf9d3eb4fc77f8d7b7243
-
SSDEEP
98304:wOW+ZaAnVboJS4P/T/S9386jZ27hx1JNWjrVWn1wgvcxpr3aQ/:Hay0J6Stxkkn1wscXL/
Malware Config
Extracted
alienbot
http://wf4sctx9cksg94528o7o.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
Processes
-
com.fisherman.president1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD5f5248cd55e5af67bcfacf95943fe0b42
SHA1924eef1eba3b88ef81ed52d79f5d60f00e2d081b
SHA2568e8ad36bd2fde745196e568a786e58df96566e50701ae52f0a84ba36c1ea3e4d
SHA5126000a4c3f4b9856286869c029441dec1dd8468aee52ac26cc58a66e9917f8435bac5ff1bc7b94039abdce9ee7f39742c91c96e9f8d5f31acd2613f8121a0cb01
-
Filesize
704KB
MD59854986904467590783cbb12c0844a3d
SHA13ac11f9a2a481c4e685a19945edeb1cf2d771c29
SHA256e4641d8421990336fb34b1522994074c5aea4571c13c01b1bfa420c1b1ac5c90
SHA5124e54b4fdf8b9932b974da7eae0205874ec4ba6aac4b8e95c366a5d9f73717485a3cf215019bfff7a6608baefcc6262728fdc5e797ab29b8b367d1db1c859aac4
-
Filesize
483B
MD50f01ecc2c02c98e51162727414ab7852
SHA11b3d5dda508ede70dd7615ad21382b16f02249de
SHA256611403da5113922f3377b791f69d1ae48c19bf23ceb15d992cbde91595dbb198
SHA5128aec93b01abeb3baa50bf3a5b36a77b7a3d7c2b2e42d2bfdf43ff1e00f7db57b63fe329e3d8cb519c4c65735fd49bb0417e9d31becc6d6d4621f470dac85f32f
-
Filesize
916KB
MD515e86a48652302ef86fa822dea8702c1
SHA175d04228e1529f420659e4c8d91b5530e994679a
SHA256859e258e53130e240adc699e9e1029624be728c3b12e63b1d9ffc8adf23c5197
SHA5126984d31943134b073b7b9be3a444b1fd2faaecabe5df77e1806bd441660d91700c088b8dc4b7ccac632ca6aeb51877653a5806f53362fb70a2e65c79e507761f