Analysis
-
max time kernel
178s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
17-05-2024 18:26
General
-
Target
872EBBA0DFE0A28DA3E91B0EE4D6DF32.apk
-
Size
1.6MB
-
MD5
872ebba0dfe0a28da3e91b0ee4d6df32
-
SHA1
6a87c50179b08740bcab9da69a869d7c881f40c4
-
SHA256
9832b1ade1907849fd7091e85f2c24bd8a4488ecd96f0638fc979d8858b25196
-
SHA512
e29e0f2b36fa161569e0b38a9e0c22365a041432ee9e84083b39aa510247dd5ffea324627d5e5ae30fd538b10ea6f7a6a7ba6dddb635284a12097dc4a6333604
-
SSDEEP
49152:7ldldTEx0nf0/ddeu6bbwKVKgBTavcGHBGFVQ:5TjTav71
Malware Config
Extracted
alienbot
http://botduke1.ug
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Removes its main activity from the application launcher 1 TTPs 10 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD55c8571c828c3032ac51dfd8d1f611d72
SHA1d71631447f7bebcc3918029b049e404095d923b2
SHA25612e94b15bb89b048c85dca877ca79cf8311a2a3a9a734d38f529e02030917805
SHA512f53ac0aab40d57bac59888347920df2dc39ecb9c3c383ed5c3e8454d8834f684e53d5b8c00ce132e1b2f60784eae85e685854c094e3f682acf508f7b2585bfe5
-
Filesize
273KB
MD5cbb32307586f83d070bb84ad6c26dd73
SHA125b3d36d28c2f4fef6c77db8bdfe8e9b1b970657
SHA256523903298635824a4ac430a3345a0dd2db0c38e3fc97f05d4242e16ecddca561
SHA512a658ffb262ecca2e18b77f15ebd14fd614c522d586945863fde5d6c84fa8a796c7966d5dd7e41fce7399ee1a38711a7e79e869106d064fddc218971d6c4eb11d
-
Filesize
251B
MD5ff855b929ab641628e5498cf24fe8356
SHA1ee7b301b4cfbfd4ea3ba98cf0c79ddf95489f4ab
SHA256130b0a78de6ec013c1fd33de31ff8b60bc7fadaa53a649411f03df726940ce24
SHA512cd04307ea3cdf954c9605adf638349aac92befbefa92857a0b1a574a2c9181f9835ae49bf0312bb83658ef7fb0546131f9d787be9a641a531461b28aed5468aa