Analysis
-
max time kernel
139s -
max time network
154s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
26-11-2024 17:36
General
-
Target
a33fa98242f62443e0304aa0c886e204_JaffaCakes118.apk
-
Size
2.6MB
-
MD5
a33fa98242f62443e0304aa0c886e204
-
SHA1
7c0ec3f1f1610e266cafe77991404d53b635b9ec
-
SHA256
0b018c290dbb5aa2af3f324f2a83c6654d5a47e4026413a6a082623bf2e35787
-
SHA512
82273a0e16b0c131bdebf51981ca99c7e2ba60092353382388b336af10547f7108850c6994ec6ddac4e34f571d9928637c4d6de00117a3d6230c3cb21f510b78
-
SSDEEP
49152:vZ+BWZHq+s1pBFu0uls9FFFHc+MxwjHFkaZNG8jIuveCFv/LNIvArN+qh4Xyb:vcBWhBe97KwhbZAfM/LqIwMb
Malware Config
Extracted
alienbot
http://feawetawe.sbs
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
crime.fashion.dentist1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694KB
MD59fd66a415ef711423bd7973ce48c5573
SHA1ca4e05ee4e101cd51e81c564e7f4da065124ec62
SHA256e40821343e602cd3069fc6eb308d2fb9a8fbf1773463bc0a08296b3e2b671c91
SHA512d1573c6ac3bbc045ede2e101a064a0a4c54607847c76e57f2bcdf8da9a6ac2120f004d534e43588e8b333c454a008c47b0eb9fffc8277eab7ff98469af37225c
-
Filesize
694KB
MD530f0e8f8cb5a5cc795e109ba5fe68c90
SHA17587ce3e1071f4196c3bbffc1722cedcad65545f
SHA256c28e626980d7fe0f86c698d2aba70fff6a90aa18ae0bf1a2c23acc466607dff8
SHA512d86ee0a7cc321687f697e083ed6135cf611ed2fd4a6481db40830bc75c3b24a2a8741e7e8bf0d4ea9496ada695f51eba6deb9a73f9e7392d38c2bf173e282c22
-
Filesize
391B
MD5e4e7b1df47bd6850a6808e9a46eade85
SHA1f2a8a4eaefab3e55a16bb27b9f1d2147473c5177
SHA2567cb504b16ff547396d5900f320ccd4ab95450f011ef1e7cb5cfaa42856cf248b
SHA51244482fef86cc212425760659c4f5d50146d9cc8bf28c0cdeb3ecbab3e6e2976f794ca7d4260464da49e272935389159e78842b187858fa1b923990e29b024a43