Overview

overview

10

Static

static

6

872EBBA0DF...32.apk

android-9-x86

10

872EBBA0DF...32.apk

android-10-x64

10

872EBBA0DF...32.apk

android-11-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    185s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    17-05-2024 18:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    872EBBA0DFE0A28DA3E91B0EE4D6DF32.apk

  • Size

    1.6MB

  • MD5

    872ebba0dfe0a28da3e91b0ee4d6df32

  • SHA1

    6a87c50179b08740bcab9da69a869d7c881f40c4

  • SHA256

    9832b1ade1907849fd7091e85f2c24bd8a4488ecd96f0638fc979d8858b25196

  • SHA512

    e29e0f2b36fa161569e0b38a9e0c22365a041432ee9e84083b39aa510247dd5ffea324627d5e5ae30fd538b10ea6f7a6a7ba6dddb635284a12097dc4a6333604

  • SSDEEP

    49152:7ldldTEx0nf0/ddeu6bbwKVKgBTavcGHBGFVQ:5TjTav71

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://botduke1.ug

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    PID:4333
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/oat/x86/Ab.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4359

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

3
T1633

System Checks

3
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json
    Filesize

    273KB

    MD5

    5c8571c828c3032ac51dfd8d1f611d72

    SHA1

    d71631447f7bebcc3918029b049e404095d923b2

    SHA256

    12e94b15bb89b048c85dca877ca79cf8311a2a3a9a734d38f529e02030917805

    SHA512

    f53ac0aab40d57bac59888347920df2dc39ecb9c3c383ed5c3e8454d8834f684e53d5b8c00ce132e1b2f60784eae85e685854c094e3f682acf508f7b2585bfe5

    Download Submit

  • /data/data/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json
    Filesize

    273KB

    MD5

    cbb32307586f83d070bb84ad6c26dd73

    SHA1

    25b3d36d28c2f4fef6c77db8bdfe8e9b1b970657

    SHA256

    523903298635824a4ac430a3345a0dd2db0c38e3fc97f05d4242e16ecddca561

    SHA512

    a658ffb262ecca2e18b77f15ebd14fd614c522d586945863fde5d6c84fa8a796c7966d5dd7e41fce7399ee1a38711a7e79e869106d064fddc218971d6c4eb11d

    Download Submit

  • /data/data/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/oat/Ab.json.cur.prof
    Filesize

    347B

    MD5

    2d5d89c9f6104db1d0183a79fa7397da

    SHA1

    c17e8b3f9ecd6d495e42adf72f3211270719b3c3

    SHA256

    399208358d5dd2f03260ea912b617923ca7b157172e65b0ee1ebed12d2086ac0

    SHA512

    eb3d7e85ac6a389da35b0d6d8b0a63432a8ce3c57f9ffe91cec2b73f871a707f0f188efe5e09884cf69e846e0be6db42fc7753b42c13d486827dabf635247585

    Download Submit

  • /data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json
    Filesize

    273KB

    MD5

    1816f834fe5d8dc1e35c093f9fa77ffa

    SHA1

    d63332f466bd7e79664e89aa12dce17066d19c1c

    SHA256

    00a0947efbd4a03a30cccd56fc1233352eab7277841031ad949acb7011e5c257

    SHA512

    a4d214682d4f63c963ed4a9e7d2f974daaaac83b0f869ee23e62ce8a9b507ec365a4b87abbfc2afe584b18fb763685ae1ddbbeec8ea9a32d3162b235cf059857

    Download Submit