Analysis
-
max time kernel
148s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
11-10-2024 13:56
General
-
Target
35262b4f3d7b7c0dea8066ffeac03c99_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
35262b4f3d7b7c0dea8066ffeac03c99
-
SHA1
cdc4b26c859979fc8283c1888f36584086cfcb99
-
SHA256
2a0009f47d4f68c7812fab90522ec41db9fbf921fe3d239f92655412da07a975
-
SHA512
1c71a31e5795cb649e99bf06de893537f18b7ae5f12886f538b1fd143979bd83d75e2fda6c25bcfec9322ef4e4930a4fb2612f1ad8296bf0e37245af332ea98d
-
SSDEEP
49152:tDxSR1g3LWoWJZUMOfoQUI8WSyh+0pHTO+FsNUaKLDmqxS3K4mWiDHUgpmNzVOPI:t7LWouZQ9UFWfbxZcKLDmI0KHfgNBf
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
begin.hard.wisdom1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
698KB
MD594ec9ce81e54c962ebdbb2dc45738425
SHA12784908c45a7c638d4f17fa72c4ccae97185f593
SHA25695899e6bf56935e1a2a88fe8b95d7cc2fa79372955026b7875e3aa498f241b6e
SHA5120f88227fbf4f5dda15f9fc9fe3dd4ebf45b73448c7dab8ed820a7463f6264caf7d7c59296e8936c0175886cdd39f1925e9b650bb3f78a406d60e0cd094149677
-
Filesize
698KB
MD52abf47fa609ea0ce2a15494b43009863
SHA1335a8129ff1b3ef53336e12cd65d3a264c857ba3
SHA25610cd63d672f58c51ca4c01c86d4a2a6783e554d57baecb04b3f21256eb4ab653
SHA512ad786c6b948e71d82e1d166ece2d988cfaab776cfe57414e32881f14a6d4e644614e9eeb27425c6456af9f784aabf4fc7528e3c00f557481bbf9513195624d65
-
Filesize
375B
MD5f22bd76fdc32159462873ff2b75088c1
SHA1f4368c2a2d78abb0c81dfd56c8a5a7bfde33d9ba
SHA25696c11ececf2a1af2f257f0020f0b3f6b849c66691171a38cceda755fcc953fa4
SHA512c41ea57bee976af7fab14ae9ddf1a553c3ab6451e7ed588e53d2afc2866052947334532a13c7abb503605ecd4e3fd98781b47fd3c6a993f5a969ec8b2a239af1