Analysis
-
max time kernel
152s -
max time network
161s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
20-04-2024 02:00
General
-
Target
fbadda1aea91b50a5adc6b855b8bbfa4_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
fbadda1aea91b50a5adc6b855b8bbfa4
-
SHA1
80df44dcf743100119e8acbd936a7651887061bd
-
SHA256
d5686b96ed9847a7b5184b70ef9401c3295f50682ad12a9127eb87ec4b4d2feb
-
SHA512
97a117024efcb7e076bce91950784a0ceacd8573a286d69164e21ba662e9957f429ad5121e68c4920b24649c6b326fce6327aa920cbd4c9e6041605ba4ecd7b8
-
SSDEEP
49152:uPdQCR7d+XwoUcT740McyPqFaHUVP6nfl56PyqQSZYfFbdWpHZWsTMKNn7E3Mk:ctgXwodMNgjU956qqQSZYfFb6HRTM38k
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
bachelor.desk.version1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
697KB
MD5629fd011536d57fd48855a79a8e81adc
SHA18af3a590cf9593cd03504b37573fddad89c7c557
SHA256baf9806357d61e6e451e75650eec0385bed0e74c87812107fda63f35628acfe3
SHA51278ece321d214547cb143413a0952e875d0646d2ab74c0eae3c3b673daf728f4f529612752ca49a589afa933270bea22ea6e2d027d4543b1193fe18c6d6cbd3b0
-
Filesize
697KB
MD5660d53e8aab29da942ba4728544f49a6
SHA14fdc19a08166d93d527b653786451161d958252b
SHA256353e1b2d19562411aff4966064c9704be08f280fc77070e5dc78bac4b2046d2f
SHA5125b879c83d90b0a3b5d19e8fe5381f42bc9de0ea5cd1833f2e2053c2271f8f8ce1e95460c34107cbc2a9a63a56502a6c8187c2f7af792a015aa5d9eb6b652b3a5
-
Filesize
364B
MD5c4071d5bda84499e4ae2dce7df258315
SHA1a3ba52ee0844dfb7ea43e08e3c989e97454c7921
SHA256e7402136eb27e3063e54bc518a3790ca8195ed30c1721bc6a02d9f2206ac3843
SHA512304cd99a65dc49cdc42b463edc67909a9da44feab7d9ab32d94019981460bab97c7eaf8cc838493294432f15f51e58feae0e353f12743cdd56a8f810826db02f