Analysis
-
max time kernel
131s -
max time network
162s -
platform
android_x64 -
resource
android-33-x64-arm64-20240229-en -
resource tags
-
submitted
02-04-2024 09:02
General
-
Target
64b9fcddb47dcd9aee6f23da3276b75fc675012a3190a3c73f23d0d36873f1bf.apk
-
Size
2.2MB
-
MD5
419f7d6d8b520f40b0a5354a967f2629
-
SHA1
6ee2d1771f0383e490c76b286e7aa56661add35d
-
SHA256
64b9fcddb47dcd9aee6f23da3276b75fc675012a3190a3c73f23d0d36873f1bf
-
SHA512
99191ef21e52f246b5999b76a3dc04a6aff5bfaea1ce3e8b7603e2193f58d505b8a124bf0092ad5ecc31c68e6b8ad5de7123b2c20a5c28f9fc98b833572294f4
-
SSDEEP
49152:snGxY44448z+viV+0pKJxRbjEFQPVIHxXVxN2eCB/t9+CJxvBZZ1ceVHbQc/NceG:snquE+0p2RbjEFQPKHxXVxN2eCB1Jxv6
Malware Config
Extracted
alienbot
http://girisapi5698.pw
Extracted
alienbot
http://girisapi5698.pw
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.post.minute1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363B
MD5f34053ce2be842deb6a280b9bdd80c2a
SHA17f33c5e0cbb301d8cb9f2c53d6d9ca0b83110874
SHA2566d26e9b02a51e12677a0a8fe32c4aa9d380d247dfc83b37fe52cd68dbce89cc9
SHA5126d8c61becb6ce1f2e84d9e60a91b91e4a88ab9291f4e0a8828bba92320b1185612524786453379acd23b165f583e227b95638866e07f6ab7b24b59b342e18f03
-
Filesize
5KB
MD55ed160f2a17889df4c9e4ad82d15a44f
SHA1e7db941d5aab5e1f5049d3c3465ec32164c8d68c
SHA256a57c5e627754ab173cd86b6d50e2321e08e1fbc9e01f2392c7e27e4e3356449a
SHA51274a185eb155aac1fd48d83912a7b82f599d5d3027a311090b2215f60449e7e2b0f82c04840c2abdeef958aded88f24572a7e6ea4f8f5050affdfb6a89f4a4c51
-
Filesize
238KB
MD5c9f11753740c9a515f625a5572dbaa18
SHA176fd170ea1ec594b13f25c62803108c0da2c7c7d
SHA256c76cc3d7e1a0a7970083bdda052dddad963167d62df72b689571a415ba920298
SHA512f1344fd41c3aaa444def9748b5835b3930ea4e380ccfe2aa840f32b4394fd0bb784ebc309fe25de1d0c2dc0380ac1de2f22106b1a53c4506ac71dcec8d7d2baf
-
Filesize
238KB
MD567a4750290b1c0dadf5a00df2d4b02e7
SHA1dca60a135962afba3357b445c3cb4a2281c11a03
SHA2566e819e614bc62c99c8402ac645c736806c8e450048df65b674b309a206830306
SHA512c3e9bc84f861868bacaa81a321b3014082338e1e909fa6ad5f5c349565c169ae975b27fa076b32fc4061de7c9a38674f87910599f705751ef4482ef05831536e
-
Filesize
483KB
MD516cbed5f379e2684d42d83d908b86cd6
SHA114479585b1b6d0be1396534eef0def542cba36e0
SHA25677d9296b571198d2093db4d25c5420f59ef5163e7e48e7edc27c1d7c5f487c37
SHA5124d20146087daf65cd7902a40d38cda71af94c76608d7cb37df03b62c173c6db50ab8b0c3991cd8ea1bfcafed2d63d8f2384f7a6a66b749e2380d592b72447a06