Analysis
-
max time kernel
140s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
25-11-2024 11:38
General
-
Target
9b3baa70f573d608d580054af58a8b98_JaffaCakes118.apk
-
Size
3.0MB
-
MD5
9b3baa70f573d608d580054af58a8b98
-
SHA1
d743eb9a025a156a0beae18022dd05b0b91487f6
-
SHA256
da43b86847f10c4578be3c80104729f243c6724d9f151bf8cfe087d09a9f74b9
-
SHA512
355c3f9f1b8f87758b2f9a4711544157aeb0b996f7681c6a3ced35b7680006ef8ca82dcc521044e5315a28f2a51ba1d07042fbe6d3d1cd3de2bfe414d089d351
-
SSDEEP
49152:LlUlKomduypj6e/HpxQvtPJ7fxMUnjDCy+3llQJoNcry2V9ago4fwQJ5DYYSqzdF:Umdzp/hKtB7fxnjWyEiJo+rXvoPAK0zP
Malware Config
Extracted
alienbot
http://buralarnelernerelerhem.club
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
group.finish.index1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
733KB
MD5c9551a9688b56dfb5563db0fb313a346
SHA13014ae052742bc195219ea7c9eaef7018496be4c
SHA2565fa92ba0bc6344c852d7bdfe2b934fac8bf1252b6c96f7a0fd1b84ce158e58f3
SHA51285cd42b4a04bbf2da38e6b9f74febabd965ebe74897bbacd72e68d5509d84c3b064e68840578dfa45ed74d3705503a5d81cea00e1eb0dd6b9ab3ae6adb375641
-
Filesize
733KB
MD5145268dbc6eaa50de1df4f9c41fb9c46
SHA14efbb3a97f6efa0b6c8e387d7f7a303a83017e4c
SHA256c3b27dc580522a844764b5c98df311c53a25715f134148c0865d97e428aa38fc
SHA512d7dd7c529e1a0b9812e1796704460ada699db83142cfdeb97bb93b4e05da2c063b4adfdcbd83d696f7158a6f7e5ab0a4b8c535b9e4dd93eac957835a53eaf5b4
-
Filesize
382B
MD507471b3d40556c5d600eea8f1244c808
SHA16240c57f36ace60d964ea528bc408fd6a136e8d2
SHA2561de034bb520ed92c1083e61747e1ea771d3e4d9ed09b9c856c32448c6529481d
SHA5123073329c364aea87e757124820691c3344697eed4ce633f995987af877bcd7599075618e96bbbe1639f5a898eb81e560ed7e0f12e64b398787d178ded6ee4b37