Overview

overview

10

Static

static

6

d92f65aa28...ad.apk

android-9-x86

10

d92f65aa28...ad.apk

android-10-x64

10

d92f65aa28...ad.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    02-10-2024 22:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d92f65aa2881c57fe66b8c87d98c9f8c152be72935ed0f88dc54bf9fee28c1ad.apk

  • Size

    1.1MB

  • MD5

    b3f116b9304e2cf4e58c7ac524519282

  • SHA1

    9cd1970133a5c1fc76e74c7b18542e3b3d8d1e54

  • SHA256

    d92f65aa2881c57fe66b8c87d98c9f8c152be72935ed0f88dc54bf9fee28c1ad

  • SHA512

    52f5410761ab6785e28c2c39d590ef2fcb4fc44e2380e2fdcda4b78b6c16cf812045d752ea9954c27761cca729d57f8344c948351fc28481e3d960c1cdfbce0e

  • SSDEEP

    24576:NMlZ/eHrtgp1wAV7iKjZSOBzkQ3lGIeho8z6yJhaJ8engJzQPq5:Sr/YOTwO7iKdSs3lonzJsJjngyi

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://185.252.179.5

rc4.plain

Extracted

Family

alienbot

C2

http://185.252.179.5

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 8 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.anxiety.memory
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:5160

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.anxiety.memory/app_DynamicOptDex/oJ.json
    Filesize

    238KB

    MD5

    2af9b8748d602d8f8ef29c385cc8bb7f

    SHA1

    2363ca5ffb0a17c1cb56a2622985bda875c37e52

    SHA256

    5b5b34c96f8281f9314d6f824d8b1c1a119076b0beb98a76b3f04d4ba3e5ec2f

    SHA512

    9af22ed60efca79675031fe39bd11d351dda680ed0d3b5cb7222e0ad382879e3e016acda4e5cd6e112325e28f527802f1f90a2be5ea30feeca155946eb2e796a

    Download Submit

  • /data/data/com.anxiety.memory/app_DynamicOptDex/oJ.json
    Filesize

    238KB

    MD5

    4a25e8d8ea6d6229cbe8398970e9546a

    SHA1

    8b9259b80ab3948fcac3fc23984d376bffbe0d3a

    SHA256

    07a4dcfd72c65b5cac8541ad8cb931f3394580bc026e1c181aba28ad8251c1c2

    SHA512

    de14b80ca5ab36ba3955bb1db32a36301552dc5f1c5dcd4e64a718754a48e8972ed60b175cd12cbb6912bf25c4003bdadeb95d5e8ff1496715031b7f6dfa32ce

    Download Submit

  • /data/data/com.anxiety.memory/app_DynamicOptDex/oat/oJ.json.cur.prof
    Filesize

    379B

    MD5

    eddd4ecc1e526f2964983fef18101e7f

    SHA1

    ccdf7bd8027d67ea800e1bacf650a0f16be89891

    SHA256

    c7a8a8ccc494541b0285daff280b33159982864ea770c800ce6862b809214cc8

    SHA512

    e9b9c0b2911e9feb1eb78b2b699c89f47467969edf2b894caaca6e5a947d981bd76b97697f83925d6f8bce66c424988c1c064d0509579149c1022446d4b7b4ac

    Download Submit

  • /data/user/0/com.anxiety.memory/app_DynamicOptDex/oJ.json
    Filesize

    483KB

    MD5

    8045e63658674de0a6a8e88d43f73df8

    SHA1

    6d2bb7fe8c39e3519ba6393a1c56db6479519cb1

    SHA256

    1ca3cfc7da90a24ecd3ea6270a30f34a3c5c9df67cfdf36914860e945f2918b4

    SHA512

    550a2f729b5174191514afb71b721b2de530dd41f365d6ef8c8d1bf15798c053c806d0e76b0fd7c9729c96eca7cab0386e3cf172e68a3aeeae8b10dcada14318

    Download Submit