alienbot | 061a13193d6f743c67c486a64fe50be243132df2fb414ce01b554bf87ba871c5

Analysis

max time kernel
134s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
24-10-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

740cbd727edfa42ebd9ae6665c0a6c3b_JaffaCakes118.apk
Size

2.9MB
MD5

740cbd727edfa42ebd9ae6665c0a6c3b
SHA1

55636ff9abfb78fa206bc5794021d92f5bebc8e0
SHA256

061a13193d6f743c67c486a64fe50be243132df2fb414ce01b554bf87ba871c5
SHA512

500a38a9f00cca61d43b9a10cb9f6f06bfdc62f35124ab898b8a71456d8ce8d390f9db9c81075d189a8995f21812865822c0135675bcc601980ba9fbdc244547
SSDEEP

49152:bUlFuZFJK2yF69IJS300TEXKJAkSn4fITJYpHfVex4E4k4x//zC1HrR+n0FAYVpQ:bUGKr09z300IXsWWITepuD4kqzC1HLAt

Score

10^/10

alienbot cerberus banker collection credential_access discovery evasion execution infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

alienbot

http://193.70.91.231

rc4.plain

Extracted

Family

alienbot

http://193.70.91.231

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot
Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Cerberus payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/fstream-2.dat	family_cerberus
behavioral1/memory/4211-1.dex	family_cerberus

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

Processes:

host.meadow.inmate

pid	Process
4211	host.meadow.inmate

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

host.meadow.inmate/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/host.meadow.inmate/app_DynamicOptDex/oat/x86/kDx.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	Process
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json	4211	host.meadow.inmate
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json	4237	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/host.meadow.inmate/app_DynamicOptDex/oat/x86/kDx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json	4211	host.meadow.inmate

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	host.meadow.inmate
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	host.meadow.inmate

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	host.meadow.inmate

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	host.meadow.inmate

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	host.meadow.inmate

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

host.meadow.inmate

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	host.meadow.inmate
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	host.meadow.inmate

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	host.meadow.inmate

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

Processes:

host.meadow.inmate

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	host.meadow.inmate

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	host.meadow.inmate

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

host.meadow.inmate

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	host.meadow.inmate

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

host.meadow.inmate

description	ioc	Process
File opened for read	/proc/cpuinfo	host.meadow.inmate

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

host.meadow.inmate

description	ioc	Process
File opened for read	/proc/meminfo	host.meadow.inmate

host.meadow.inmate
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4211
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/host.meadow.inmate/app_DynamicOptDex/oat/x86/kDx.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4237

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/host.meadow.inmate/app_DynamicOptDex/kDx.json

Filesize
733KB

MD5
4d07a028b11e74be051ef630999846ba

SHA1
e07f2dae08c5501af368996fc8b33360c8579854

SHA256
da1505a00b9c085efde3287ef08020103b7c28b64fa77db07eef0099d2339809

SHA512
190821d8b3244965f835b04af1d115340648cc295675292fd5e4444889cc254e078c5be939d7a8efa9be92d16717127171f001322e8d2d6ab6f162655a1a3a56

Download Submit
/data/data/host.meadow.inmate/app_DynamicOptDex/kDx.json

Filesize
733KB

MD5
9e41d4c26bcb1f57f0769facdb640e87

SHA1
4ee36bface37742da0eb1eb0e21294a73289ca61

SHA256
c8cc402727a34c4d37969aeae3e3abc0e9e51f487b0f1b552017e3e9b8958e41

SHA512
e872a487b075edc1975e05c38567f6927b66808016a1b38a37614a32688bf68c498f9e157c11deb3eee6f3da848181036e394ae6f04ae256856de1a1003fd150

Download Submit
/data/data/host.meadow.inmate/app_DynamicOptDex/oat/kDx.json.cur.prof

Filesize
523B

MD5
4cf960ef900b2e967783b478f0bd8ea2

SHA1
27fd8002cc575ff7fc75ec55258370913fb9f891

SHA256
a73eef44132281e0819a961a95969d7e077db60c5f362fc648c79255cb5ae22a

SHA512
334deae8db0a9fbcc31adcb211c9db2e237e6f90aef8c915968228959f3ae37699b9037ccf8110fe6bea02b5dbc683b09a05b7e1456fd70c82526cb1e402f856

Download Submit
/data/user/0/host.meadow.inmate/app_DynamicOptDex/kDx.json

Filesize
733KB

MD5
abc0f9ab4561ef76c5db4451154ab2a2

SHA1
9c62171a799b75a734bbe297b95929ead9aa5573

SHA256
2bfa72b32fd225d7bae7f2de592b90045f95e2615728617bb349f3b3d40ab272

SHA512
039312fb069206fe505936be791fbb2e6b37bd6d7e8a178e9dac76021b8d83d446c2a3099efe04d69ac3d8deba0086d551207db91ca69f6b60da9d5124a72b07

Download Submit