Analysis
-
max time kernel
114s -
max time network
163s -
platform
android_x64 -
resource
android-33-x64-arm64-20240229-en -
resource tags
-
submitted
17-04-2024 04:20
General
-
Target
f505a92ec494fcb1bfeddd0a76b922af_JaffaCakes118.apk
-
Size
4.2MB
-
MD5
f505a92ec494fcb1bfeddd0a76b922af
-
SHA1
7d96dd3fb13ad5e54c32b8af9e689547befad53a
-
SHA256
f96fe97104d33743f476e7b3c5bbd1f5cced9bfa4837bab347c46e4eaf3309ea
-
SHA512
d78c9a5a892920786edb478522fca913f9f0da88e1c342ce378e580f693cf0bbac42d3e479a9ca5887c32dd2ae0d858cf67450f79d43ab22395ffc5b9ec9165f
-
SSDEEP
98304:DWe/Oh4YWVQv413RpujwQTavY3qIH3u50jISGjE5fmo7:CKM4nHLpus+GobR7
Malware Config
Extracted
alienbot
http://dndterdsveqesdasf.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
republic.publish.nearby1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
616KB
MD50c47fe6926f94d478b9ba7e290cdee70
SHA15d3a63fee4fcbc8f0ba9926955883ad6c3fd63c5
SHA2560ea2fbad2e1293328e2d502641e74483c79156979d725ab7a1a9972e7763e02d
SHA5125a9887b6b0010f1840de5fc6046706743bc34e2963e6d60c5d6a7319b54f55a7a8b6cb7277204740973e4f9361228cc92fee17c109a33edaa9f64fba273cdcf6
-
Filesize
616KB
MD557f231873349b8606df1a99be6fa03a7
SHA1a64abb323585749f45216341724d5b6d6308e2ea
SHA256ad5de5befd809d30703dcb4c6329ee038a1f47179dd8d9fa6d89f4e4513518a8
SHA512a5e6d480202ae953c4136ece30e0568237c3e691e75b11ef733d24f3ac8f579d2fc7c0758727f247defdbba87cb5689fb46cabc04e2ce1e64f215b3982fef68a
-
Filesize
767KB
MD5cdfd8b9b05ca05d08cd74bf769c16eb0
SHA1f6672d4d3632ed1553f4b79feba5f298ae98af40
SHA256e0a3b5ef7b50917a378da8ab4f8a185527bd35df4edb8b94a752be4891f7d8b2
SHA5122963dedb714de59771293fb73471fe06035bc9540d418b6e70687651c100e461cf2202ec6581b5ed8f9f25d75d1ddf406f364a4e19260df1f6c2a017d29d6980
-
Filesize
307B
MD51bdd0687e51c2b9e21b883685dabbb0c
SHA1f62d6b1369e696fcdfeee2d25d30629ec739f3c1
SHA2567825fc9ef1092a26df7220b788c7649cdc1628f51295fa208ef212a31567192c
SHA51236bb27d8f96fe8a6fce7cd1bca4feec7af82f6a6d6ab4d76402fc585ba74ade774cbc8665b776f96d26c8847e35f560f4ee97821b5c392cc15d58556b33d1bb6