Analysis
-
max time kernel
146s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
03-10-2024 22:23
General
-
Target
a87567a434ff674e99b52c2a9c7894e2a832bb6b95ac745ef744e0a5234150ca.apk
-
Size
1.1MB
-
MD5
b90ef190ff57aeee96d73bd825dc9344
-
SHA1
e504a42098297e206dc05292750d0d567ae37d33
-
SHA256
a87567a434ff674e99b52c2a9c7894e2a832bb6b95ac745ef744e0a5234150ca
-
SHA512
3e884b345ea56df4645514a997c3643047d9182a6bfd04ff4b3c6aff70f686446213322e255712b3f7b02f95f1e918dc0d82a388e38374dfcc97e254c89286ab
-
SSDEEP
24576:XgT0d22b9jortvQkDemYmhcEHy69BWYx17d22h4:XS042CptDe4bv9QJ2K
Malware Config
Extracted
alienbot
http://185.252.179.5
Extracted
alienbot
http://185.252.179.5
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.moral.oil1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD52dfa2b507819c1bc63cf91d9686dc081
SHA1911304b6e69b1d0976c029042f7f2103b0364cb5
SHA2563c55d50e23d5e15a5473ebce5d481b7e40c9a28490689c766303ee9c6e46b190
SHA51237887855f69319f796adeae4c9c158efbf427247d8fd4e9000cab9c8ada66da976e8b8132e9faf1b7814cf545e9ff297eea8626278c3e2c3ab2d936f22e6e2fe
-
Filesize
238KB
MD5eca35610708bbc883092e430602c73df
SHA10c756235269b158637b47b302d02c30ea57c80ac
SHA256787a22e73538ff3a1528b696dd08388e6942aed307872c2aea361c2ca5f8a755
SHA51221fc2e1951fccc1156521836d1f236b88090e32f8b0fc9f353a3bccf2ab2009b3986dcec37889b265d08a2a61f9d43e470fefcb963ec5b8dcfe0a7e381fecbad
-
Filesize
483KB
MD5c9962d31187a8862c3f84f11374fa3b7
SHA119a72733e04697611d32a47fcb6ffd81bc986c0f
SHA256e618c247a75cc657076b2655133c0db4bec0d3a3723af696b0e2884c99a17e77
SHA5123107fb8fc879e4908d62f10ea7f2220392bbdcbf1bf76e3b54c8281779ac3be5c911ac1a043af4227be01b1f3d362d4246abc2fb7143cbb2e21b37d29541bff4