Overview

overview

10

Static

static

6

4e0206cb0b...18.apk

android-9-x86

10

4e0206cb0b...18.apk

android-10-x64

10

4e0206cb0b...18.apk

android-11-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    17-05-2024 02:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4e0206cb0b0ab3591de5313386312083_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    4e0206cb0b0ab3591de5313386312083

  • SHA1

    6b74ed4b595d19ac9b82400cb5b7ec63e1644dd1

  • SHA256

    662c3234cfd236b8d0bf01ebb8aaa9e0eb2b3617c8cc5f0fcacfae11ef341adc

  • SHA512

    b4f75ca7ae7f0961f4393082402fabc92af9ced7c76a3cc67d942ce5738abd6857df5734add1ad03bfe457a4bbf6a2e02f0e59c098bdf2a3ded633aa592d3eb7

  • SSDEEP

    49152:Y/93X51JtkegOkjy0oHdaRLGZk7FUx58RPE/W4aQW3QF6kNkQ4tdo6hIFofhB6NY:AVX5bbgOkj1oTwyO8Mtd3hI2j6N4D

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://manavgatselalesi2.xyz

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    PID:4259
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln/app_DynamicOptDex/bYtNhmI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln/app_DynamicOptDex/oat/x86/bYtNhmI.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln/app_DynamicOptDex/bYtNhmI.json
    Filesize

    752KB

    MD5

    82df753bfe30bfe6a862ae8ee0130a4e

    SHA1

    29b07ac2593621fc1ea358b1c194ff28c9ee35da

    SHA256

    fe81bdb173ef4e8f9414fd22fb89c1d59e8414972ba19f659b169651dc8f30b4

    SHA512

    637c518d54d6f86fe6320fcadd211135974012ca8f553b2fb4c19ba741d987170ff2933a8e18b8ec8c8c8d9676814931622c724cb930bbf9cf04d9ea59fe61e2

    Download Submit

  • /data/data/pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln/app_DynamicOptDex/bYtNhmI.json
    Filesize

    752KB

    MD5

    fecaac6ac2282e7158c50b3896ca4252

    SHA1

    626f6bfa9d29d3c86087b95f41c3e32d470e7156

    SHA256

    be0e11cbac3ba9a9de043d74bb152d7580ddd93f8fb829f580cfb8050a689e2a

    SHA512

    dc510d748bde42416b63f0fd9ecb44bcfc7b447c44ecc6d00c64bbfd1dd63cc31de8164efa9907de8e95da7af2e943070fa4f9e348265bb729b0a2cbe790e64a

    Download Submit

  • /data/data/pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln/app_DynamicOptDex/oat/bYtNhmI.json.cur.prof
    Filesize

    491B

    MD5

    5f1d253dd66453bad0c4d1c9e4e1e831

    SHA1

    9de8e17db340c8ff423bc6f9401a9daa71cf1859

    SHA256

    4fc24cc68b0d99bbd78e00a3132c17221fe5f58f2760e886af89e0a78543a1a1

    SHA512

    0cb6fb5a1e261529e086293386f222afa9c269ba4c221099559244caa82cd96bce489898300f9e2e7827eec0c816acae88d6e1f9632cf82c845d579ff2b343be

    Download Submit

  • /data/user/0/pxklywasaxprwfem.kztpmfwglmahcpzqwxbo.xpdgxmopln/app_DynamicOptDex/bYtNhmI.json
    Filesize

    752KB

    MD5

    b459c63913d4942d83a496e96220f642

    SHA1

    1aa03057698878c0a909aad68dabed9af913d36a

    SHA256

    3fe9548cdac0a8b9d863939ee8df8c831ebf0b003b72e139af8c7f481512eb99

    SHA512

    f0f0526e1836b20676c4a54cc4dd713e9576e42ec748190ef27349a1b760ceca400315315d534b25605e64b33152b2a2f52abffb10efb29fd34729c11e8b5068

    Download Submit