Analysis
-
max time kernel
142s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
17-04-2024 22:02
General
-
Target
f73d07ab3f091ba4ee6d19843d228714d36074d331605de91d674cba7a8440e0.apk
-
Size
317KB
-
MD5
3560fa9200977ce6c2d93443d9ac0bfd
-
SHA1
880d50db4f554d6de232d1c44241600b2fcc51c3
-
SHA256
f73d07ab3f091ba4ee6d19843d228714d36074d331605de91d674cba7a8440e0
-
SHA512
65ce833cdd8e3cc3632073d1914825b85c5d144cf8f30d4080bd3c870e5076a44d478aa36081c58cda0125eeedd86d69b5149dd4d1330dd73c60382d06173b6f
-
SSDEEP
6144:u4TktnNxW+tIs00QxwE3+xvoyeA1dSVUm6X5oLW9JjJl883/h3/REbZG6:ubqx0xEAoz6Qw88353OV
Malware Config
Extracted
alienbot
https://81.161.229.185
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.mhiauaqmlacl.ypmsfwbkjhsbeoz1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).