Analysis
-
max time kernel
149s -
max time network
146s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
13-04-2024 16:24
General
-
Target
Player.apk
-
Size
3.7MB
-
MD5
934d0d9425168fb975604dae2b93f000
-
SHA1
410d06356d4417111adc21595fd34e8fac47b13b
-
SHA256
b7869b123154eb461599a0b3f30fc18174787b0ed05a825d4371d54112de24b2
-
SHA512
6bde86e6f731ab9cfbab91789817561d7ec48141811271a12bb33c0322025669c6ebde7a530a49e633719bcd4a438ed9efd67468d3a3865e2dd293e9318283ea
-
SSDEEP
98304:uRW/t6GJtaDudtOBNkfmEnd/VgyMd+RDr/qrx5h:8WjnOB2f3ntMeDy
Malware Config
Extracted
alienbot
http://apkinstalll.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries account information for other applications stored on the device. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
leg.grunt.hub1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD586e0c9d94944285573a77e4b90d7057d
SHA1f6af962ede455f0b879b27b4bf97cf949d60305e
SHA2565583e65591338e795f702b91163a18405cd1fecf8386b3084ab0c118d5747605
SHA512e25411c2509fb6134902cf1b10b8b918167af632743dea542f683f33cc62b1d3066f3eab9a4c9060879616209911ad7f9b1a8195c1acf7a7197e632c3bf4b6cb
-
Filesize
720KB
MD5942d3a82b974137ffa673c062a85b156
SHA1a10f7192e11b596aa43db1979e9926035a395364
SHA2568270325878efa484e783c040dbda2a8ec2daab3246033b5004183a54d7b25fff
SHA5124248619f0f4a2ea660b5b545c3671785c2c56e78439c4c518083bd1f893247506d69b6140b56b6c899c21cac2bbbbbee38774ace9f40ebd32e73e3562f341f52
-
Filesize
517B
MD5cdae0fb861385546ce5191a436d0f4d2
SHA16bf72362fb2e7963e4f309a574ff84ab05eafdcb
SHA2560c13c61bee87152c4f789eecccceba8c0bac661208c9f05492f0afe089d82f67
SHA51222fc1708646b5e7d42a8cee19ff847112ed22bb61051dde974ac35a3d5a97c23cf6e753a3981867a121a9ced841b63ba880e5da179697e2bd8007410ae0af080
-
Filesize
598B
MD56a4753459c62bfd956aee814dc3650a6
SHA1aa1efba71de44c798cedc14db115b784aec0bacb
SHA25650152fcee36652b0223092ecca8bb81247af72060f6358e3febe23a6be5bc737
SHA51204c48f8c19515105f985cb0da65fd2a8bc9f50ef5b1c496c38f85a9eecb2245c11df9ea4b5b4680f9942ff13a6651e920f4ada03d85a67a6a3768884ec6e620d