Analysis
-
max time kernel
145s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
06-12-2024 01:57
General
-
Target
ca7aec7eacd0f2820c73bf0a9523a382_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
ca7aec7eacd0f2820c73bf0a9523a382
-
SHA1
c9eb3866d202582495c07abe5d8fcdf47e6c98d0
-
SHA256
fb38636d1afb7c6df603ac4f441de7fd3d01c79c97577a5aca0afef8b2b8041b
-
SHA512
0fc462d58394a029eeb015c23f0c7b2d39a924a7c0efd8ef02451bb99c8503f330917b3ee1634d309a07a404eadb02420a2e4c63ffa118fd83c5a0e7a02e85ab
-
SSDEEP
49152:rHJ/x3X4bGFT1ypsI9l8cxyvWdGHgNvewS2u6P6dlHq00b0J9d27jNP9aayTGgC:PI9sI4cwYHAh2P1QJ9yjZ9viGgC
Malware Config
Extracted
alienbot
http://rareqtereqqer.sbs
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
rival.draft.pupil1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694KB
MD5372fe4205030dca83c8453cbc6633105
SHA118a41d36fd758d7bd2801ee23e64930d10303386
SHA25629cec6cce0a502bc5a845616360f78af53bc0304b73a69f0fe848f1a685a4114
SHA5125abd2caeaa1d77f38f3de0156d4e518082e5f4547e2349e63643e89252c60ac8904987836b73af4be41b5b18d5858da828a772c37fa404db610d190a5e244730
-
Filesize
694KB
MD5a1b9e4ea8a4cf58351b9f2871e4b1b74
SHA1a4b02aced8993dbbafc61082fa64c58c21bc75df
SHA256d1201aa63a020b6a9fdecb1c220653ebf6c7440d64bc113ec88c9885a3d6f979
SHA5120286706372cc120cd2ba5e7509e439192f4e1699ab412c91c6b5677dd170c08253d88f6548fb23c2ffcc4ca924f405cf21c6d898eda93d87a6935557e26a761e
-
Filesize
395B
MD57cc11b03992486a4b65bc8c12cc6c2ad
SHA13c8e733714d84dba85c2e91b8aab2dc1b4658e4d
SHA25655e0dca78d14fd1be6d7c6d99043900bc38883965dfe3d3482d2135f4032c02f
SHA512c862538876c8594f4a5a2c8e00041df7ac8508581255100671f1c221746005f30d7761762762ed2e8aee15f61603f559eeb4d035c75b9f020c3c3e27d4ccdf9a