Overview

overview

10

Static

static

6

41b9a5f1a3...f4.apk

android-9-x86

10

41b9a5f1a3...f4.apk

android-10-x64

10

41b9a5f1a3...f4.apk

android-11-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    27-11-2024 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    41b9a5f1a347465d4471f89f37c621d4946266c113a20411eac49c915522e5f4.apk

  • Size

    1.3MB

  • MD5

    78e0cfe2ab9ef072be32319d756b8472

  • SHA1

    7a90ce611490ae1a84eb7028419e6b3b77d27ccd

  • SHA256

    41b9a5f1a347465d4471f89f37c621d4946266c113a20411eac49c915522e5f4

  • SHA512

    3c0a12b894f54abef562c67d3c9cfa2ea91c984b9e9f7ca43fe80dbe8191ca562ae4e291366b66fab28f446de258a9230b3f87460ef282672fac11fa60283895

  • SSDEEP

    24576:GQjlXllX6MuanL5hggyiJuvDMrJJ+JBrohp6kAnEP0Zt3q58xAL:tuOL5hggvsvDQJJ+JBshp6rEP0+KxAL

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

https://ramosahneleri.net

rc4.plain

Extracted

Family

alienbot

C2

https://ramosahneleri.net

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Alienbot family
    alienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Cerberus payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 8 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.domain.special
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:5243

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.domain.special/app_DynamicOptDex/jw.json
    Filesize

    238KB

    MD5

    639ab35f9f51613dc40a3cddbd33cc33

    SHA1

    a4b686bedd74a9a4ef047bd01ac39ff711a03ac5

    SHA256

    d98a7d51bafd8fca2ee9de5bb54e1c6d62aa88db82148761b20c569ee225c198

    SHA512

    905a8b8718aad01bc3635e5a06a5fa5a9b7a250f25bd8a592f0267dd68534d89d5b934df13f48236caa418bffdb5c534c992f65813ec23d804b1779c2f24c424

    Download Submit

  • /data/data/com.domain.special/app_DynamicOptDex/jw.json
    Filesize

    238KB

    MD5

    d9416c04bd2c971c54649226a24e3eab

    SHA1

    e44835cb24a18f2f5cf2a947f426f3134ce679b8

    SHA256

    e161058d3335fe864e11a7d6a7a1b2688bb54bc4f0e0a109a244973f7cfd612f

    SHA512

    5ab61d8d0f9f17317f3414cf3c46e60e4d5972663d43abab7745c6c3f6dfb3a4e932d6281fa9814ddc04f98f80486a0f536cc2d8091dcc05f8eaaab1507e197a

    Download Submit

  • /data/data/com.domain.special/app_DynamicOptDex/oat/jw.json.cur.prof
    Filesize

    441B

    MD5

    3ad4077df7d267af9ff0898f934da23c

    SHA1

    9c634b7f9e53361302718fd70bbcaa26509b6a41

    SHA256

    14ca6cee4b3b35c07861261ac94907baffd9b3156105e642015501740462ed8d

    SHA512

    d6256c443c4e2b4bdd8147391e63612341545663e2e45c957777de2abd41e0c3a8618fb2a74730fd0f5350e5f01c216cf4a7926317f16dc85e8d9a9b8ad23644

    Download Submit

  • /data/user/0/com.domain.special/app_DynamicOptDex/jw.json
    Filesize

    483KB

    MD5

    eca424e286f028877957a7b6b2ed6f55

    SHA1

    622183dc855c84a0b564aeb98fd36ea7a4c1cdf5

    SHA256

    8a3124b5fbec659ad22af414838fa2f3cc5917dcb2ee08764b4f20c105199b83

    SHA512

    322a02fb94951a1c6f17f6f0169f2643f7de758ceb7c3e758488007a0ec3a980735e0496de12471e924133948151ae9d4d5c282084a71050934939d52dd440df

    Download Submit