Analysis
-
max time kernel
152s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
01-04-2024 06:01
General
-
Target
69b70fb07d660fed15ed712f8f9a0921_JaffaCakes118.apk
-
Size
4.1MB
-
MD5
69b70fb07d660fed15ed712f8f9a0921
-
SHA1
c33887bd9e30769e93a28ef0765044d00eb2d47e
-
SHA256
f83fbba014179718feb59c3701711d2287fe4ebf7a9c2fed7845e9037cde3690
-
SHA512
0783e0e003e7c77bee09c517f7e1d4b3c2904e3e2efdebbbb3c5fb0bd6c6c319ea751626c13ddf39e030b5a7e3a18d77af3e64d3b2bec04b6bdc113f47fabbc0
-
SSDEEP
98304:IKoUEsuxCUZjOc5KmP5ncscYMBT50kISGitpSX:vo6qYObb1i8
Malware Config
Extracted
alienbot
http://t0zv563p3rrmcspg2x76.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
determine.hotel.fragile1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD52438023a366ebe81d6f14c05d6869ad0
SHA12dd16fb24fca0326b684c30669b4940fd4b6c768
SHA25688454cea1f5c37a4bcb9f88daedda0b60e0ca38dc537fc0359054ee42785da03
SHA5126edd004a3a0acd5d446eaf4d4cf8a2a8937b8b684145e498f01e914fb7349dc4faa067e8539d6e1cde5663e18b994ca6b87aab8c62a0040e0fb222d353c592b7
-
Filesize
615KB
MD5f027cd86ff8245e0513150feab0bc65f
SHA192656b897eb179d98f10b0b1d0500b86095c3a3f
SHA25650f790246ce7d5f31ab3268d6ea29369fb4e18473c7e5c84667419a47254e46a
SHA512f70edaed98bde463a17f272ef2c2e4234eab309fcea69477b3207888dc249d7b0b39b7ed5750a854c31af095afb0cc841e9b333720bb275a0f00c9e30af0d7e4
-
Filesize
767KB
MD5f1f47b1c23326ec70659748887f215d6
SHA1a5d7c025165083d574800459049bd1e613379bc0
SHA256d491d6845cac2e316276d5b57da1d983f634b6df3d7f59e8c8496e0823f476b7
SHA5127265eafe3a48b869080e8cfd4cc0e2241bf28f4b1e6898199ead74c8d29adfffdd2a7997c338b29138bc68746f56acc0fcbce38b898302efdd8cdd7bd3f8e6c0
-
Filesize
232B
MD53710d6829990551f73852bb4741499bd
SHA19efffa7ff159d93cd1f5fd7d04982cfd73ccf851
SHA2564202ef73660e71be1d3d1f595852a9c952f64ff2f39640968122de8072aed152
SHA51258c9901e28a5e3bea269aa053da624b35be94ab60f47466493f618f0f2f32a681f56fe5b659b9f317acbc239f221ed1a6bdfde1df90a6d70a62371856b96c9a5