Analysis
-
max time kernel
140s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
26-11-2024 12:58
General
-
Target
a2112d3c6b589061b7c97fc2df9ee154_JaffaCakes118.apk
-
Size
2.8MB
-
MD5
a2112d3c6b589061b7c97fc2df9ee154
-
SHA1
34e5b6a7785a08570a0aac4f12f64f8cff4d8274
-
SHA256
8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a
-
SHA512
ed95d1ec68e4632816943595ba2a8ccb5452b9a654d3898155e02e3cb5d94f4ae115e6aa0ffc29284a5f4964623ec1c59c92cc20a77b77665faedb3e7060df1b
-
SSDEEP
49152:qLff3a3QVebJIOj+h3QsyGGf4Hel1QfaZCL2C9eIzQPC0T5KYH/Q5xKySEX:Wa3QV6tjwQ9bzAvRQa0T5DHI5EySEX
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
involve.what.draw1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
659KB
MD56d1e85f28a94032f4636fa077efc9228
SHA15ecc78d09547f6ecb7dc3bbcf981c73364bdfcb1
SHA256bf91bbf1ae0b91482f6815ea67447f68bd4d93a23ac36d7cb8e4c68bb086890c
SHA5127810cc1875db0f214efeee80885ae197e3ec18974e680df6c4f306977664cbb4a505c1a5888c10c5be0747579d6028ca36078bca8c73c7fd25e636e81427be8c
-
Filesize
659KB
MD54c087c1b4143eb14c750c1d042ee298c
SHA1f994f56d7d3cbe5533f9172a6bc6abbec2f8292b
SHA256694ed4dce22a28358dd773c56472283c7dd20a26dfd0958e558a945690608103
SHA512f1df38bfa45996411ab14f32a428fc84008af6e3ff4b0ac4aa26a041f5b681576360eec87520cee4534a5154c75b0cd9173c197c89fad1e6f69dfedf22f3e829
-
Filesize
366B
MD509d2912dd6030c7516734a85c547b3dd
SHA176607b9ceec751723d07b95e17eb6634fd1b6e0b
SHA256098c76b40065eea3d4eeb1f664b3b9b23dacc6b273f54e1bb3ec92629bd2634d
SHA5121e02f051e368aceaaafc988718768f113a31cafbb56356f453bbea23ad97a6404a52c1840435bdadd31cb27481d379ec279eee2ea3f33dfd9b7eaf62bbe4a31c