Analysis
-
max time kernel
139s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
19-10-2024 20:39
General
-
Target
5e8fbf5138cb86522cfc8891f637af8b_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
5e8fbf5138cb86522cfc8891f637af8b
-
SHA1
749412b843bfd62210b8ef47e5ee4527c7d97abe
-
SHA256
3b4d55a0aaf3ea759e6aaf5229b7b87bd870ee37863d10b1d2f286c742e0add0
-
SHA512
8f5de80e97da44be96755670717eac230904255c2e79c4c33f66d97c9262da5c13b3938478d24bc6f8f4190fde37441fcf59474489a64ea5cf889d47f9b05cb9
-
SSDEEP
49152:lbBRZhP56mpt9MADbnfK/tP6QJmV8WZ7HFmE670F9m/3ehYRDxoupSHNVEBQTHme:lvP56EWADbniw8D70avehWDxZpSHNVE+
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
popular.roast.slow1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
665KB
MD5b02290572cba4ae810c16e5a7545b0ba
SHA121bed143f93ae9ca734150eb83aa3cadf26c9825
SHA256647bd9419a1fd6634473e3a385799478a75a90ab183a90f6034b70c6ac8f6e5f
SHA512824282591b40636d0bec7bcc8c0b892d42a1bf4843b01abcc7a93fc612097e5a3bd04a4f7b1fff7e13843934f517873ed5dc9f0b532087a58d6f76f4810ff4e9
-
Filesize
665KB
MD5e8016eb81d199579c71c9304d8257c7a
SHA13443ca802f19d82d7fe5ec72163d6b612ef49cdf
SHA25672606804df52bca4a8769f76701c86100b4d657a6f75df9225e16cc26188f9c4
SHA512d4ee0842850dba1eb811845ea92db25775c3d5a810930ab35de54b2ab56502fe32162eca988e123e802c6945849d691c525d36bf950430774fd509cc81e7af62
-
Filesize
346B
MD53387873437668aecfe1c474f5303ae9b
SHA1c55aef8d2d345ef8e439dee84aa1476c2bf6696c
SHA2564769a7874166e7f5eaaf43725c9f8e2cb77a5f977597980c45dea662566264e2
SHA5128f56130bc4ba31bbe1fdb669c8928e79b0c47a958bb12ce192a372072d84dfad19763319c88fc41606dea1a4ddb3cc5c4a2f16d815282594ddb8586e27db8508