Overview

overview

10

Static

static

6

9e9b4280d0...18.apk

android-9-x86

10

9e9b4280d0...18.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e9b4280d0e4b94e83becc8815b86d6b_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240403-drykzsed2v

  • MD5

    9e9b4280d0e4b94e83becc8815b86d6b

  • SHA1

    65aabe741b47a842f0b49c698549de18d3be40a7

  • SHA256

    165aac61794ce24b3d51da7a23c976e7c54a37b5c8840dabd39bf6c2d7e213db

  • SHA512

    1e7c71e29aa9dcfd77779a442bd5bc9dacf3cf469d0a8d0b2b7417225a3035e0bc85d131e55d51a5e314381a2b7371e887ec5deaba75ea2e7ac03babaa5386db

  • SSDEEP

    98304:1y8FTK87K4SzY5rtjo9vRG5fw3X08B43slEW6rjj20v:o8Fm14KwaX08B59yOY

Score
10/10
alienbotandroidbankercollectionevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://asbyow8su7h3i0mdydz1.xyz

Targets

    • Target

      9e9b4280d0e4b94e83becc8815b86d6b_JaffaCakes118

    • Size

      3.6MB

    • MD5

      9e9b4280d0e4b94e83becc8815b86d6b

    • SHA1

      65aabe741b47a842f0b49c698549de18d3be40a7

    • SHA256

      165aac61794ce24b3d51da7a23c976e7c54a37b5c8840dabd39bf6c2d7e213db

    • SHA512

      1e7c71e29aa9dcfd77779a442bd5bc9dacf3cf469d0a8d0b2b7417225a3035e0bc85d131e55d51a5e314381a2b7371e887ec5deaba75ea2e7ac03babaa5386db

    • SSDEEP

      98304:1y8FTK87K4SzY5rtjo9vRG5fw3X08B43slEW6rjj20v:o8Fm14KwaX08B59yOY

    Score
    10/10
    alienbotbankercollectionevasioninfostealerpersistencestealthtrojan

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

      bankertrojaninfostealeralienbot

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Acquires the wake lock

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks