Overview

overview

10

Static

static

6

107ca9c97b...18.apk

android-9-x86

10

107ca9c97b...18.apk

android-10-x64

10

107ca9c97b...18.apk

android-11-x64

10

Analysis

  • max time kernel
    177s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    28/07/2024, 08:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    107ca9c97bfe522ae4e69fdb2b17fca6_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    107ca9c97bfe522ae4e69fdb2b17fca6

  • SHA1

    9695a3a919a414edfdce30c0f240df82134bb897

  • SHA256

    23d0b7233ab3f7195e58d643703b14d38030b833c0d8820e42fef09f55ed4c36

  • SHA512

    1da12b4029b1e98533542a6a80c66942d1943c9cdcc0490d9cfa0ffe53bb8f37719a861d821b41ad22571c10196515418b4d2213f12e35c1315b78d291931dc5

  • SSDEEP

    24576:XIEs8ZMmIHDJERdPz8Z/Pwxbz1hmTSGfYqmE7XRDxmIHWDP1UxzSlehpOJx5KrIF:NjZoHDJERdo/YRz1sSGQE7hDhHWuR+vt

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://xancc4fp.live

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • zxistjp.sjxi.eddnhgyngpw
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4234
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zxistjp.sjxi.eddnhgyngpw/app_DynamicOptDex/tUrPil.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/zxistjp.sjxi.eddnhgyngpw/app_DynamicOptDex/oat/x86/tUrPil.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4283

Network

        MITRE ATT&CK Mobile v15

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Event Triggered Execution

        1
        T1624

        Broadcast Receivers

        1
        T1624.001

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        2
        T1628

        Suppress Application Icon

        1
        T1628.001

        User Evasion

        1
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        System Information Discovery

        2
        T1426

        System Network Configuration Discovery

        2
        T1422

        Lateral Movement

        Collection

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Stored Application Data

        1
        T1409

        Command and Control

        Exfiltration

        Impact

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/zxistjp.sjxi.eddnhgyngpw/app_DynamicOptDex/oat/tUrPil.json.cur.prof
          Filesize

          340B

          MD5

          ee3df100bec97f3b6b48fd8ee84d4d79

          SHA1

          eff9284f1add9079741091bb8ed0b9cd295132fd

          SHA256

          efff12c821ff632dc38ef63332b242a2bad97ce81de491f2a04afc776e318d97

          SHA512

          cf62ac3fba41753afb11bb67a921d015fe4c02c3dd48e04f060d6e0982aa61549d3075a94f1a700fd0ec1adb3966e4997628c4291f3428f4e364d2f199384986

          Download Submit

        • /data/data/zxistjp.sjxi.eddnhgyngpw/app_DynamicOptDex/tUrPil.json
          Filesize

          461KB

          MD5

          5525d2d7242a673bd14b2646eb6892ce

          SHA1

          8569d69cb00c7f258a3cba753b0f84a526efd59d

          SHA256

          d75652f974958ebe94068708bf8a85927d62d66bacee864b52a61f4e879da3c5

          SHA512

          135b7cfebe8e0dd5f4aa5ba851ddee9fa3737a690882f810b3c863cc0868b3cc9af1899d33627cfa20f0007d47401825a42b7cf74c169b824b79ff1a476d1371

          Download Submit

        • /data/data/zxistjp.sjxi.eddnhgyngpw/app_DynamicOptDex/tUrPil.json
          Filesize

          461KB

          MD5

          54dc5fa4683ae04014be3c09c64863cf

          SHA1

          200700369c9b3d8692acc3e2cf94d1848afb12bb

          SHA256

          ae61721e460243fb0bf4dd6a03eb26610377ccf63490c5dafdd30cb5c4843b38

          SHA512

          159a52babd7260183d55737fe61bb897a1efd9889e838711815b2807b6e77fc0d380ee37c6f20921fec61c02506e90e66c0dc8440beea2131ca9f118c00ec2da

          Download Submit

        • /data/user/0/zxistjp.sjxi.eddnhgyngpw/app_DynamicOptDex/tUrPil.json
          Filesize

          461KB

          MD5

          5e626b68e3e64e2c4ab1b7db4de7a93a

          SHA1

          5a4994f6ec0e3d4c347879e528fe22ac68de9e9f

          SHA256

          7cafa3318b4797fc796edb7af2388aa1e49b766df20c9fbf6db38947011dfa43

          SHA512

          5450d7ea871e9a9bf090b2a594309491bcd9c08013fc9fefd0072d5132670cc81f2ff7cdc2de9c8d240fdf7b63927be9c896370eabcac9031ac15bdce9bb9d3b

          Download Submit