Analysis
-
max time kernel
149s -
max time network
153s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
15-11-2024 22:08
General
-
Target
1a3ebdd4f2596eb4eb68f00fbfbc2736d6c622e8a2076c70fb78da76a8fe5ac2.apk
-
Size
3.3MB
-
MD5
6448535085c034d2c3959fbbdcbe7c2f
-
SHA1
0564d5bb3e1dc1465926614a55f1654865766fb5
-
SHA256
1a3ebdd4f2596eb4eb68f00fbfbc2736d6c622e8a2076c70fb78da76a8fe5ac2
-
SHA512
1fc5281e1b79b93edcfd98c31e012b5f5e81e53e4968c10ba1d86e055851c54933152bde92c985b97542b783df45c848872c4c1e293d56bab83ae0f94ec2e93f
-
SSDEEP
98304:rSOk6fzXmCQSgUFe6ksAzK8DyYnfJLJ2jBrQ0:TbQdUFe6ks6tnaBrN
Malware Config
Extracted
alienbot
http://xstata.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
disagree.gun.bracket1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
751KB
MD53e7bbcda4aa85f21404a569ff6f05c77
SHA1bb879831c1f5102f3b0c2e89e3178efac08d9974
SHA2566313692d3c3f99c7da8ea6cf2e224aab6d6c511b12a11d9065dcaac513c86c77
SHA5128bd3d92e338dcbef61b384da68283f4b48a99c14ed305207a08d39be8af73b593f1fa05221ae90587165a237df47b0b397c84b980c58804f0f52afabe0be779f
-
Filesize
751KB
MD54fee0da7ed2a9db77372ed116c859682
SHA1b3969a2793e0da4ef5de9be0b0c290310a851fc0
SHA25655480eed73dbc312b3d1d44bebf18d8e5870d143cb6349b1abdbb745b0fb59c4
SHA5125a6ac3963b19a8fe5e18da8f6b3f6da0e58b182a07872d1f942df0d7958acb8b8aafa2a616685cda23161097cf16f352bc56c6d5979b9106efe416c1f9344f7e
-
Filesize
419B
MD50362a6f4fc22716edc5f71abe4eae32d
SHA1f24baf8d00114db3ad33fde4f36e10c7ee290a1a
SHA256c6ea8811132033f5881cf4f30ef7b38ad61f41b06f9bbb3d7b40f33304def7b1
SHA512c8fd8649bb33b19e4c74332884ce0a19cb1f683bc7dafd0e9a9d4fecf05ac356e0adef2f0ef4f2a77c04b94a71b085b6770484e9e6bb027e2135dd099eaed6c7