Analysis
-
max time kernel
152s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
20-04-2024 02:00
General
-
Target
fbadda1aea91b50a5adc6b855b8bbfa4_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
fbadda1aea91b50a5adc6b855b8bbfa4
-
SHA1
80df44dcf743100119e8acbd936a7651887061bd
-
SHA256
d5686b96ed9847a7b5184b70ef9401c3295f50682ad12a9127eb87ec4b4d2feb
-
SHA512
97a117024efcb7e076bce91950784a0ceacd8573a286d69164e21ba662e9957f429ad5121e68c4920b24649c6b326fce6327aa920cbd4c9e6041605ba4ecd7b8
-
SSDEEP
49152:uPdQCR7d+XwoUcT740McyPqFaHUVP6nfl56PyqQSZYfFbdWpHZWsTMKNn7E3Mk:ctgXwodMNgjU956qqQSZYfFb6HRTM38k
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
Processes
-
bachelor.desk.version1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
697KB
MD5629fd011536d57fd48855a79a8e81adc
SHA18af3a590cf9593cd03504b37573fddad89c7c557
SHA256baf9806357d61e6e451e75650eec0385bed0e74c87812107fda63f35628acfe3
SHA51278ece321d214547cb143413a0952e875d0646d2ab74c0eae3c3b673daf728f4f529612752ca49a589afa933270bea22ea6e2d027d4543b1193fe18c6d6cbd3b0
-
Filesize
697KB
MD5660d53e8aab29da942ba4728544f49a6
SHA14fdc19a08166d93d527b653786451161d958252b
SHA256353e1b2d19562411aff4966064c9704be08f280fc77070e5dc78bac4b2046d2f
SHA5125b879c83d90b0a3b5d19e8fe5381f42bc9de0ea5cd1833f2e2053c2271f8f8ce1e95460c34107cbc2a9a63a56502a6c8187c2f7af792a015aa5d9eb6b652b3a5
-
Filesize
412B
MD58c4937a039dccc9e03dace85294b5526
SHA1d5d9b56702d455249002449672114a5d738c1d3e
SHA2564bf1711a011bb7e650d25bf0f842bd44543429698a990b75bcdf6ea7613497af
SHA512dd1f41c5811590bcacf3b3594aa2d3ce103b64b66c3bf378a55395452f9c045af9451eb817540a2a5a8b827131682314962d52447b1ac669c80e9e46c4d9052a