Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
13-12-2024 12:13
General
-
Target
eb73dee8702ed7e3582e4d6ac3f47e74_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
eb73dee8702ed7e3582e4d6ac3f47e74
-
SHA1
eb2ed2bed4c2a0409d7e17034b408ca676dbb254
-
SHA256
29e4bdd32b7f308d1a138dcff54c30ac11aa5c178f6e19fe413c7999fdb120a9
-
SHA512
d24c3ffbc340c86c3f471c510bcadf41dc591199f9166865e685eacd71abea24d7868000cd91d35c3e1e0d0988229014601c3c892f12a6e96cc396acca5ab4fe
-
SSDEEP
49152:DfxBJaK11uGSEJJ4y6pkcyoyheHwnT+wpLhdpqPCM4Wk7g5FZGNYJ1hbSJHw:kK1A0WkNPrCKLhnFjKkNYJIQ
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
flock.trip.upper1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384B
MD5923f3a8971976b388c5e3bb82f998f60
SHA1a6cafd192eb1d79d437a88abe8856e3fd0cb4c9a
SHA25689c58cf0a64b1aa437f7626b9fb9c7712321888f11745d72644f0b443a39c697
SHA5127af814a95a02be99dbd9aa4445865aa7af4a16c880b91995e5204e1a895863dc981eee993d521bcbe8ffef382e03117ba50d18155ac1fc4e7d18d775041c8d26
-
Filesize
729KB
MD5c838317e3a64ab9be76c92ad3351bfe2
SHA1d30d3e45ece87ffc65fe9bc965717aa7b7ed3211
SHA256935a133607090b950afe950a3a8715c6fa6d7b4cddb789e4a6a331dfa2b866ca
SHA51294e90cb7fefb6cef9f6c7b7450f3efe79ca26d0c85b4a22e6d4e28e31c295f118646ff3e8a1ea9f42d1e672aedcf20b339bfd0411848679f7865bca32126ee7b
-
Filesize
729KB
MD54ecd31144926e22a143aea10ea36a045
SHA1472512b071b5e9ab3fac8e603f6c891e56c77568
SHA2564804a8c361bc4bac8c5dc7570eaecc28e1a6cc7cb98d8034214c94a071ae5bad
SHA5121f07d948d8a3f348208e77e4421dd10cecbe995660bfcdf13d13ebd0f2960235cf19d986c12fcbc74c605054759626fa0d2c987004f99fcebec00dc47b1cd7a6