alienbot | a0876d4cde77a0378cbf1ce15d188abf397b33e6d836bd5f799c798d311e2906

Analysis

max time kernel
152s
max time network
151s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
19-04-2024 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faece6df07cccc010c8a2eaaca541bab_JaffaCakes118.apk
Size

3.3MB
MD5

faece6df07cccc010c8a2eaaca541bab
SHA1

f9f22b1404b8088835371666493fa3f0db2ef71a
SHA256

a0876d4cde77a0378cbf1ce15d188abf397b33e6d836bd5f799c798d311e2906
SHA512

84a11fb311bee827104b09ba6f1ff3433f0fc34a5c24cc363e90c8ccd75f024ae885a2902f7c741a5c3049e9b61acd304218e6ff97d5c1d61c4191f643524980
SSDEEP

98304:98vL6E8gsu3FIVLZC9RzzrheGseo/REQJqtFAt:98T6EvseFIJGRVeGfRSt

Score

10^/10

alienbot cerberus banker collection credential_access discovery evasion infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://34.89.218.199

rc4.plain

Extracted

Family

alienbot

http://34.89.218.199

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 1 IoCs

Processes:

resource	yara_rule
/data/data/cage.couple.say/app_DynamicOptDex/FyDkedD.json	family_cerberus

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

T1516

T1513

T1417.001

T1417.002

Processes:

cage.couple.say

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cage.couple.say
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	cage.couple.say

Removes its main activity from the application launcher 1 TTPs 8 IoCs

stealth trojan evasion

T1628.001

Processes:

cage.couple.say

pid	process
5032	cage.couple.say
5032	cage.couple.say
5032	cage.couple.say
5032	cage.couple.say
5032	cage.couple.say
5032	cage.couple.say
5032	cage.couple.say
5032	cage.couple.say

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

cage.couple.say

ioc	pid	process
/data/user/0/cage.couple.say/app_DynamicOptDex/FyDkedD.json	5032	cage.couple.say
/data/user/0/cage.couple.say/app_DynamicOptDex/FyDkedD.json	5032	cage.couple.say

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

cage.couple.say

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground cage.couple.say
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

cage.couple.say

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser cage.couple.say
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

cage.couple.say

description ioc process

Framework service call android.app.IActivityManager.registerReceiver cage.couple.say
Acquires the wake lock 1 IoCs

Processes:

cage.couple.say

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock cage.couple.say

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	cage.couple.say

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	cage.couple.say

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	cage.couple.say

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	cage.couple.say

cage.couple.say
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cage.couple.say/app_DynamicOptDex/FyDkedD.json
Filesize
683KB

MD5
093a68da9134a9cb0ed5bc43914e27c8

SHA1
083ce669c1ce06418eb8ae27a00065c36ec2db51

SHA256
33670d11885f0b2ce4377acfe56a9ffcd0e0f84c71fcbd5787686156184bc40c

SHA512
1df15247589cd68af60c6de6451f406a775ce79e7001b30020d0fc6cca076ab0df2d9fe84a2b4d495a504c9948168fc41229f1095e1c19b78be371112f9daa9f

Download Submit
/data/data/cage.couple.say/app_DynamicOptDex/FyDkedD.json
Filesize
683KB

MD5
fc8f5bdb82f665dcbeaccd5cfd521c17

SHA1
f5c2c93e2a7729d4d6e2ba5897aa762d02ca5a14

SHA256
9b07380e45833bf412afd51d05c8f9c6bc346ae35a33b96c9527ae1d37e1895b

SHA512
61765ef9a751d8545a3dc4a5068d716f17982952177ff771b9d01735ed63642496d712a573ef008eb3fa3dda26f42343771822f36c91c4f45e5fee93e7048377

Download Submit
/data/data/cage.couple.say/app_DynamicOptDex/oat/FyDkedD.json.cur.prof
Filesize
492B

MD5
cfdfb618a8ed55d368ec25fcb55fed2f

SHA1
5bf9d23b1ebbc89a06f4e4ec4e0acb8d3ffcba9b

SHA256
095124dcea1a4a09107dc11d74f9f4c4c32805e5c4c75b48ed4750c74b589e34

SHA512
8bb6686405f7670f8190f3c45195949caef47187ac656bc64b2d7a5a9aad16c14232c8350cd28aeddbf22e6a3938a1f7aa61dd0475d1616c458680cdc0d75ccc

Download Submit