Overview

overview

10

Static

static

6

1742936fc3...18.apk

android-9-x86

10

1742936fc3...18.apk

android-10-x64

10

1742936fc3...18.apk

android-11-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    05-10-2024 10:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1742936fc3118792758eaecef0991ea3_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    1742936fc3118792758eaecef0991ea3

  • SHA1

    c939e399263a53f5e5e4563085e5ff85a7ab0352

  • SHA256

    057809e3b42b8b7a4f437a8cdbed5f7b78da66127794f8a9bf4f686693544be3

  • SHA512

    13fd7c45e0af19d37336bea774977ab074aecb285f24e7e95cb23bb0d4b460f1165ccd014d532f8c9a45842bd2779205834048eb06896b4b9819581090a30b7a

  • SSDEEP

    49152:rPUYehPA5dhtJMZejNQLHmWSCcA0+RBKCRvwCXj0AxhAg6o:LUYexAbdMZUOlh9xwCXoAxhKo

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://rareqtereqqer.sbs

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • able.version.fever
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4251
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/able.version.fever/app_DynamicOptDex/BBtYiAa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/able.version.fever/app_DynamicOptDex/oat/x86/BBtYiAa.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4278

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/able.version.fever/app_DynamicOptDex/BBtYiAa.json
    Filesize

    735KB

    MD5

    3b68ce7ea7294a71a587dc962d15d0ea

    SHA1

    a3ec21155c3dfd7e60e9ad2e34eba2fe617e62c5

    SHA256

    e90d108a13e45aa2cfd567da2027882201630f123b893a36c22a78ed6616d68f

    SHA512

    100c667f8fd17986a740511ab54b1015b172368c1e9cfe70333cce8f89fd649067bb89e74da4380053e7f2a8a68928d3e13bf0fe3695276cb7351b153b27f370

    Download Submit

  • /data/data/able.version.fever/app_DynamicOptDex/BBtYiAa.json
    Filesize

    735KB

    MD5

    d77b349c02be5c74972e14cf92890e2c

    SHA1

    b4da5de3a4d634ee494d3c970946d0a8dbbc27f6

    SHA256

    1054587f97139175e5c23a5374a2a9123a4183f16bed070e03537aead750b8ab

    SHA512

    7701756fca6df25bb5b2a1c7dd776a6a301047ab6b955c54b8572e0047431fac34c79d0c5c0a7393f0f602c6bca0d43087c9b7f839c533774ea7df16ad00da12

    Download Submit

  • /data/data/able.version.fever/app_DynamicOptDex/oat/BBtYiAa.json.cur.prof
    Filesize

    492B

    MD5

    597156495f4ce45c51bedbed5d10e109

    SHA1

    9221c5544abb760778dba30ca8d0731844e7a589

    SHA256

    d54a97ed1cad2d0aecbb877997d1443a5258eacd345998545f428f418e8f1da0

    SHA512

    9cd82b7e989ffc7c51c1635b4c2a1cff040b3cbdc2672128a74902913e4c44eea887fda2264b92c96a0e2e32ae4e7a5f581b59a4cca101725fb15df6f230b7a9

    Download Submit

  • /data/user/0/able.version.fever/app_DynamicOptDex/BBtYiAa.json
    Filesize

    735KB

    MD5

    9ed553fae66dcecfd1d5c9636c8ad65c

    SHA1

    e1005e1d0a766e77efd43fd65e2a40292d570393

    SHA256

    dfec00945d5b23983263acf2b7580cb02b77640f9016a9acb7922a3f97bd0a27

    SHA512

    1611c8f3ce45e4f3555fa4651df66e96e07469eff8073951c8fec14aada87052bb12b9a6c33c70af41ec99365b2cb40df056a383be1b2083566d4b54bbddadb6

    Download Submit