Analysis
-
max time kernel
100s -
max time network
134s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
15-12-2024 17:32
General
-
Target
f505a92ec494fcb1bfeddd0a76b922af_JaffaCakes118.apk
-
Size
4.2MB
-
MD5
f505a92ec494fcb1bfeddd0a76b922af
-
SHA1
7d96dd3fb13ad5e54c32b8af9e689547befad53a
-
SHA256
f96fe97104d33743f476e7b3c5bbd1f5cced9bfa4837bab347c46e4eaf3309ea
-
SHA512
d78c9a5a892920786edb478522fca913f9f0da88e1c342ce378e580f693cf0bbac42d3e479a9ca5887c32dd2ae0d858cf67450f79d43ab22395ffc5b9ec9165f
-
SSDEEP
98304:DWe/Oh4YWVQv413RpujwQTavY3qIH3u50jISGjE5fmo7:CKM4nHLpus+GobR7
Malware Config
Extracted
alienbot
http://dndterdsveqesdasf.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
republic.publish.nearby1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
616KB
MD50c47fe6926f94d478b9ba7e290cdee70
SHA15d3a63fee4fcbc8f0ba9926955883ad6c3fd63c5
SHA2560ea2fbad2e1293328e2d502641e74483c79156979d725ab7a1a9972e7763e02d
SHA5125a9887b6b0010f1840de5fc6046706743bc34e2963e6d60c5d6a7319b54f55a7a8b6cb7277204740973e4f9361228cc92fee17c109a33edaa9f64fba273cdcf6
-
Filesize
616KB
MD557f231873349b8606df1a99be6fa03a7
SHA1a64abb323585749f45216341724d5b6d6308e2ea
SHA256ad5de5befd809d30703dcb4c6329ee038a1f47179dd8d9fa6d89f4e4513518a8
SHA512a5e6d480202ae953c4136ece30e0568237c3e691e75b11ef733d24f3ac8f579d2fc7c0758727f247defdbba87cb5689fb46cabc04e2ce1e64f215b3982fef68a
-
Filesize
767KB
MD5cdfd8b9b05ca05d08cd74bf769c16eb0
SHA1f6672d4d3632ed1553f4b79feba5f298ae98af40
SHA256e0a3b5ef7b50917a378da8ab4f8a185527bd35df4edb8b94a752be4891f7d8b2
SHA5122963dedb714de59771293fb73471fe06035bc9540d418b6e70687651c100e461cf2202ec6581b5ed8f9f25d75d1ddf406f364a4e19260df1f6c2a017d29d6980
-
Filesize
308B
MD540b11534db9d3fca6c3997571f76266d
SHA12bd0405f2dab04585143e8e79ac4e6845614a65c
SHA256a645d99ef570a9951704e703317b9f038c08e632c357499c6a612926f3edc192
SHA512576d0ac6448ec86ed885858b60db39b833b888b75e3944fe6d1592550d8733a066ee96013023eb49c9daf4b54927e81adc8063b0cdfb83fb0a9e809576a8ba48