Overview

overview

10

Static

static

6

5e8fbf5138...18.apk

android-9-x86

10

5e8fbf5138...18.apk

android-10-x64

10

5e8fbf5138...18.apk

android-11-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    19-10-2024 20:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5e8fbf5138cb86522cfc8891f637af8b_JaffaCakes118.apk

  • Size

    2.9MB

  • MD5

    5e8fbf5138cb86522cfc8891f637af8b

  • SHA1

    749412b843bfd62210b8ef47e5ee4527c7d97abe

  • SHA256

    3b4d55a0aaf3ea759e6aaf5229b7b87bd870ee37863d10b1d2f286c742e0add0

  • SHA512

    8f5de80e97da44be96755670717eac230904255c2e79c4c33f66d97c9262da5c13b3938478d24bc6f8f4190fde37441fcf59474489a64ea5cf889d47f9b05cb9

  • SSDEEP

    49152:lbBRZhP56mpt9MADbnfK/tP6QJmV8WZ7HFmE670F9m/3ehYRDxoupSHNVEBQTHme:lvP56EWADbniw8D70avehWDxZpSHNVE+

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

rc4.plain

Extracted

Family

alienbot

C2

http://194.163.136.78

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • popular.roast.slow
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4249
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/popular.roast.slow/app_DynamicOptDex/eQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/popular.roast.slow/app_DynamicOptDex/oat/x86/eQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4277

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/popular.roast.slow/app_DynamicOptDex/eQ.json
    Filesize

    665KB

    MD5

    b02290572cba4ae810c16e5a7545b0ba

    SHA1

    21bed143f93ae9ca734150eb83aa3cadf26c9825

    SHA256

    647bd9419a1fd6634473e3a385799478a75a90ab183a90f6034b70c6ac8f6e5f

    SHA512

    824282591b40636d0bec7bcc8c0b892d42a1bf4843b01abcc7a93fc612097e5a3bd04a4f7b1fff7e13843934f517873ed5dc9f0b532087a58d6f76f4810ff4e9

    Download Submit

  • /data/data/popular.roast.slow/app_DynamicOptDex/eQ.json
    Filesize

    665KB

    MD5

    e8016eb81d199579c71c9304d8257c7a

    SHA1

    3443ca802f19d82d7fe5ec72163d6b612ef49cdf

    SHA256

    72606804df52bca4a8769f76701c86100b4d657a6f75df9225e16cc26188f9c4

    SHA512

    d4ee0842850dba1eb811845ea92db25775c3d5a810930ab35de54b2ab56502fe32162eca988e123e802c6945849d691c525d36bf950430774fd509cc81e7af62

    Download Submit

  • /data/data/popular.roast.slow/app_DynamicOptDex/oat/eQ.json.cur.prof
    Filesize

    503B

    MD5

    058ae1cce6849a6c9bfde36d3d3695f8

    SHA1

    f1f37f1023f8e97f44d735df755669c94d70921b

    SHA256

    59e1539053d30b15cf4d72eca24ebc33512cd76467626b39ed43d8c4c2ac0557

    SHA512

    4b13c937b7989e0422f023df9c2328b7cbf030fa8b78ef29dcd46aff657887b3106ddcdec4c06c7acdbdaa8a7b138c3c9ea543fc759aca70665644a5bcd06f91

    Download Submit

  • /data/user/0/popular.roast.slow/app_DynamicOptDex/eQ.json
    Filesize

    665KB

    MD5

    28614f1a8b58161bd7fdcc5197f077a4

    SHA1

    1822577e8a2e77ad61023c0f8d5b518dd43e6eeb

    SHA256

    60ca6b1144479830f02938aed4f2979334c6b8b9bc6160ab5a4a572909f0e272

    SHA512

    d495539a7277abdca2d94bcdd82d36c9f3b9532f67a2055edca76eea7effacfccbf050b0597309dd692c8e5d32d491c85e86521384e50ba73643f0f752205f7f

    Download Submit