alienbot

General

Target

75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118
Size

2.6MB
Sample

240526-ta5wqsce73
MD5

75fe4067f1b0a3e7f30453575c47f254
SHA1

cc8ec6ac3178050bc10b5e5c2dd62b344eafa88c
SHA256

79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497
SHA512

f02a2ddbc45cc8f855f3832fea8fd6ab2ec08c84f5ee446f0e3fcd26689db71c8793048d2c35b6896e373a24461d969e7c589347fac7886f24ed3ba856677214
SSDEEP

49152:pVYesMiZMd49s6Y4nFMFErIbjcmQW//nlRDBui366+DpBIe1TQN8ytk5iWrwkZyn:pSDTTrJK/nlBqN9BuJtk5ifkZyTHekWk

Score

10^/10

Malware Config

Extracted

Family

alienbot

C2

http://manavgatselalesi2.xyz

Targets

- Target
  
  75fe4067f1b0a3e7f30453575c47f254_JaffaCakes118
- Size
  
  2.6MB
- MD5
  
  75fe4067f1b0a3e7f30453575c47f254
- SHA1
  
  cc8ec6ac3178050bc10b5e5c2dd62b344eafa88c
- SHA256
  
  79b384ce704a6dc24f0af972cc24e12ed6f3a8f7ab3739d6279642435f399497
- SHA512
  
  f02a2ddbc45cc8f855f3832fea8fd6ab2ec08c84f5ee446f0e3fcd26689db71c8793048d2c35b6896e373a24461d969e7c589347fac7886f24ed3ba856677214
- SSDEEP
  
  49152:pVYesMiZMd49s6Y4nFMFErIbjcmQW//nlRDBui366+DpBIe1TQN8ytk5iWrwkZyn:pSDTTrJK/nlBqN9BuJtk5ifkZyTHekWk
Score

10^/10

alienbot cerberus banker collection credential_access discovery evasion execution infostealer persistence rat stealth trojan
- Alienbot
  Alienbot is a fork of Cerberus banker first seen in January 2020.
  banker trojan infostealer alienbot
- Cerberus
  An Android banker that is being rented to actors beginning in 2019.
  banker trojan infostealer evasion rat cerberus
- Cerberus payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Cerberus

Cerberus payload

Makes use of the framework's Accessibility service

Prevents application removal

Removes its main activity from the application launcher

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3