alienbot | afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830

Analysis

max time kernel
141s
max time network
148s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08-10-2024 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b12a6b58a37dfa57a7563883efabea_JaffaCakes118.apk
Size

2.8MB
MD5

24b12a6b58a37dfa57a7563883efabea
SHA1

0a93e315530ac6a65f701869bebfd48c7ca40486
SHA256

afa85eacbcb9e4cb13d962449663ca0060eae579b33e0806c9ddecdc8d095830
SHA512

e6ba864194558ee1afd82e2edf84412e76c45f3c4d31f07f241bf29fbedaceca855b29e31ef283ab536c7533e326218ccb3a3201634fc23e83fc29f7cfd77cf6
SSDEEP

49152:J8ujrWNGlYI9L9kjA5MtSRqzYsy6O7EHK35UPPCaBNNPfjElyDHp9nqHcnReiIQq:JkNahV5/UY9Dj2nnPTplKcnRHI3qm

Score

10^/10

alienbot cerberus banker collection credential_access discovery evasion execution infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

http://194.163.136.78

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_cerberus
behavioral1/memory/4260-1.dex	family_cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4260	asset.margin.pipe

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4260	asset.margin.pipe
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4287	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/asset.margin.pipe/app_DynamicOptDex/oat/x86/SgK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json	4260	asset.margin.pipe

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	asset.margin.pipe
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	asset.margin.pipe

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	asset.margin.pipe

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	asset.margin.pipe

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	asset.margin.pipe

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	asset.margin.pipe
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	asset.margin.pipe

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	asset.margin.pipe

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	asset.margin.pipe

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	asset.margin.pipe

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	asset.margin.pipe

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	asset.margin.pipe

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	asset.margin.pipe

asset.margin.pipe
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4260
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/asset.margin.pipe/app_DynamicOptDex/oat/x86/SgK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4287

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
1221a8143f5ba9aa97092d586920d054

SHA1
e53b302d47d078701bd3c096833d3cb4692749f2

SHA256
fa23ec08d24705deacb41545a3ca21779e2b1c0845dcd400d27ba2754eda2547

SHA512
53af00702725719d386685be945e943cdeb5d435deb9dd4a71ce4b3ab56a3e86efc4da6061ea56f8a82953617ead7f26047c1a32770e77ca70a4d8eb47424afa

Download Submit
/data/data/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
f1184c0f3cd2fa70c590484035e9d32a

SHA1
76fa99121538d74ac89a9598f107e2c4ece7717f

SHA256
5d7cc286da591ab8f960570810260bda6dff78f51d5b03229841eb84f76ca434

SHA512
d17c2c61be6863e945fa514e9d7c1c6dbed1781baf35c8e630cc7c68608aec31f233f1fd2cdbcbeadffe0a0ffc479d06442fe263476691859036a8b78b32ae9c

Download Submit
/data/data/asset.margin.pipe/app_DynamicOptDex/oat/SgK.json.cur.prof

Filesize
493B

MD5
33643c3e650834d709172fb029b06807

SHA1
3db75aca620701870211d57ad90b606e46f2c84b

SHA256
13108ce565dba345ef91fecfffbba80a8b36f76ab7b24cdb26bb8b010cc0f80d

SHA512
a9dd19a79d1c885cc33bc1ac875fe4f57b77202f2b0a8c60d0e1b7b541b629dafbb97ad2e9835e91dc1d2e43412bc99f23eff9ea57fe1c76ac552dd9e6acf31a

Download Submit
/data/user/0/asset.margin.pipe/app_DynamicOptDex/SgK.json

Filesize
685KB

MD5
69dd8c5d9510aaae23342829a01d7f0c

SHA1
209e46ec9e59426c9ae429e650f9e027a6482a6f

SHA256
f96281706809f4c32303845a0819bb4fe0976e272209a2a3bddb632c24625974

SHA512
04f0ad7fa9825b6bb19aa1c079ff74d0f23cf343009ab9b2bd0fbbd7c28bded16c27edba87f11027fe48d78f51beec2cd8fb0937de6e4d547027fc22a244a5b4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads