Analysis
-
max time kernel
145s -
max time network
135s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
06-12-2024 01:57
General
-
Target
ca7aec7eacd0f2820c73bf0a9523a382_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
ca7aec7eacd0f2820c73bf0a9523a382
-
SHA1
c9eb3866d202582495c07abe5d8fcdf47e6c98d0
-
SHA256
fb38636d1afb7c6df603ac4f441de7fd3d01c79c97577a5aca0afef8b2b8041b
-
SHA512
0fc462d58394a029eeb015c23f0c7b2d39a924a7c0efd8ef02451bb99c8503f330917b3ee1634d309a07a404eadb02420a2e4c63ffa118fd83c5a0e7a02e85ab
-
SSDEEP
49152:rHJ/x3X4bGFT1ypsI9l8cxyvWdGHgNvewS2u6P6dlHq00b0J9d27jNP9aayTGgC:PI9sI4cwYHAh2P1QJ9yjZ9viGgC
Malware Config
Extracted
alienbot
http://rareqtereqqer.sbs
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
rival.draft.pupil1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694KB
MD5372fe4205030dca83c8453cbc6633105
SHA118a41d36fd758d7bd2801ee23e64930d10303386
SHA25629cec6cce0a502bc5a845616360f78af53bc0304b73a69f0fe848f1a685a4114
SHA5125abd2caeaa1d77f38f3de0156d4e518082e5f4547e2349e63643e89252c60ac8904987836b73af4be41b5b18d5858da828a772c37fa404db610d190a5e244730
-
Filesize
694KB
MD5a1b9e4ea8a4cf58351b9f2871e4b1b74
SHA1a4b02aced8993dbbafc61082fa64c58c21bc75df
SHA256d1201aa63a020b6a9fdecb1c220653ebf6c7440d64bc113ec88c9885a3d6f979
SHA5120286706372cc120cd2ba5e7509e439192f4e1699ab412c91c6b5677dd170c08253d88f6548fb23c2ffcc4ca924f405cf21c6d898eda93d87a6935557e26a761e
-
Filesize
326B
MD5ec10176162a7aa491834914baa1bc463
SHA1b85f1f45032b5902a4fb351cc2f5b712f1081e0c
SHA256b7f8a29bdc3018a1d1c25dcdb8b59f06ab268a730263ddb73ee7fe3ae7f71877
SHA51290be2deeade3fc816512d93f3b0f9495f142d79f7b7a20083819bf2048cef7e94fb10d6f180b32b307a8a85bad6916215222a4b99f19086ea9a48d3ad7e82ac9