Analysis
-
max time kernel
139s -
max time network
153s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
01-10-2024 22:11
General
-
Target
89483eb024e0ef407ed654efd45527390b51559453473fa388357216c38d0979.apk
-
Size
3.7MB
-
MD5
ff065ca5e98ea4d5b8ace14c1fdc9471
-
SHA1
333f5d5aae17366685ed3783a81bf7bf888bbc54
-
SHA256
89483eb024e0ef407ed654efd45527390b51559453473fa388357216c38d0979
-
SHA512
de2787aaa37d5e13bfb76ff5f1e6aa770fbd5e37d1161bce848193925ae33ec3901e01083f7affa6a642b0c03ffbfb42054219ca6a06ee66fdc566cd0a5eb9ab
-
SSDEEP
98304:hX0jXcKay8gfBYLdWfQhln9o/5//9v5BngNFTUgIwrLlg/m1Va4k3hAxU:4Xc88AYLdWq9GXBng3swfAm1ED2U
Malware Config
Extracted
alienbot
http://1vq90ijfs1rqa6ngork8.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
co.expose.airport1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
697KB
MD5b5380c8a12bf679a95360b83e903ee54
SHA10c7eeb44fc233dc6744f4022b8ef521b48fa913d
SHA25659b550b9db71057e60dd05b874e7d8f61a9d631a2780d82c66843df651389923
SHA512b008ece4012fc406c5d6e2ec275bd693bae4bb3ab5e45d69933124d76b61087150cb68eb1b2bc191c731c2019ef5b96d689dac5bb748078bd178d1631e565342
-
Filesize
697KB
MD57d73162f16110b7846c47e9933c39b7d
SHA1e41d3ad627d628f80aad0cbce73c56cfe4934ba8
SHA2561134506c78cd333905294454f5f07d26281feb1ed012f85c725733971c333b10
SHA5125bc62c7b8e06365d4778ce8956c97d3d3aa305e2cdbe27ac73125316f6c2d7be9544f3f881fc26d697f0f67b8bbbfeb346a90b83fdcf1a46461552c1bb4a9e6f
-
Filesize
902KB
MD51483a6149888ebdb02257b9ea6becb36
SHA1cd1f436be8d30904000b19906797ac071d7f3b9b
SHA2568368ae02add3552f005861f9e18a6bcd342428cf0bc0c2eec47a25d6baa7629f
SHA5129817719deb4a20af91c493b1ced878b34a9764ac4ff54096dc650c0f476150d7331d24dec82e7cd90080cb864e9a437e04fe45a141111cc9ce84919f61e6857e
-
Filesize
317B
MD5c0ee80d4d06a42dc2ce49fd94924c078
SHA15bc1341141eb2f191d1c3d00c3eab820f7af35f2
SHA256d8e0e1210adb8474d2a7ea4395c3a1af7a39fdbc2674d712f67b0752105f4e3a
SHA512c3bfb32bc02bf3a4c0795aff5d0b82f0974443fa08286ce6e5a71545d1fdbbf1d662c987f044b527bb89c1f688662919c4e400abd12b480b2467fadecfc0b597