Overview

overview

10

Static

static

6

872EBBA0DF...32.apk

android-9-x86

10

872EBBA0DF...32.apk

android-10-x64

10

872EBBA0DF...32.apk

android-11-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    169s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    17-05-2024 18:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    872EBBA0DFE0A28DA3E91B0EE4D6DF32.apk

  • Size

    1.6MB

  • MD5

    872ebba0dfe0a28da3e91b0ee4d6df32

  • SHA1

    6a87c50179b08740bcab9da69a869d7c881f40c4

  • SHA256

    9832b1ade1907849fd7091e85f2c24bd8a4488ecd96f0638fc979d8858b25196

  • SHA512

    e29e0f2b36fa161569e0b38a9e0c22365a041432ee9e84083b39aa510247dd5ffea324627d5e5ae30fd538b10ea6f7a6a7ba6dddb635284a12097dc4a6333604

  • SSDEEP

    49152:7ldldTEx0nf0/ddeu6bbwKVKgBTavcGHBGFVQ:5TjTav71

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://botduke1.ug

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

    evasion
  • Removes its main activity from the application launcher 1 TTPs 3 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    PID:4509

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json
    Filesize

    273KB

    MD5

    5c8571c828c3032ac51dfd8d1f611d72

    SHA1

    d71631447f7bebcc3918029b049e404095d923b2

    SHA256

    12e94b15bb89b048c85dca877ca79cf8311a2a3a9a734d38f529e02030917805

    SHA512

    f53ac0aab40d57bac59888347920df2dc39ecb9c3c383ed5c3e8454d8834f684e53d5b8c00ce132e1b2f60784eae85e685854c094e3f682acf508f7b2585bfe5

    Download Submit

  • /data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/Ab.json
    Filesize

    273KB

    MD5

    cbb32307586f83d070bb84ad6c26dd73

    SHA1

    25b3d36d28c2f4fef6c77db8bdfe8e9b1b970657

    SHA256

    523903298635824a4ac430a3345a0dd2db0c38e3fc97f05d4242e16ecddca561

    SHA512

    a658ffb262ecca2e18b77f15ebd14fd614c522d586945863fde5d6c84fa8a796c7966d5dd7e41fce7399ee1a38711a7e79e869106d064fddc218971d6c4eb11d

    Download Submit

  • /data/user/0/xqrkrtxlmsyjzrrzgbbzyjaky.wzyuyoryrfflsijm.lndmbzkmninuonnzfapnr/app_DynamicOptDex/oat/Ab.json.cur.prof
    Filesize

    206B

    MD5

    97202af802964237425473f0d96743cc

    SHA1

    233303c151e778d0266ce97ee1614853e28700dc

    SHA256

    d9d0d5192db8054d7f18e76d7e8f34f7bd5a9f0a61d4cc6e787fae28941440fc

    SHA512

    ea7a57f6176a2fbf88e07141739f5ae7e5d9d1f7da3c8bfcf62f96c6c87c1effdb582aad28fc053fdeaf9824a32aab59cd05ad8efed1adb992e5259ec01bfdbe

    Download Submit