Analysis
-
max time kernel
145s -
max time network
158s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
17-12-2024 22:09
General
-
Target
921e9e33af6ea92830a55fd13abb063402e6e08e480f470d8ab6b48a016aaff3.apk
-
Size
3.8MB
-
MD5
c0217aad6827cff1389d406174e2e9f2
-
SHA1
0cf0b1664c30df97bcb0ef9c1bb707927ae5731f
-
SHA256
921e9e33af6ea92830a55fd13abb063402e6e08e480f470d8ab6b48a016aaff3
-
SHA512
0f284753cb5d17955ca7edf5d086880e79d01c869a2e77b98085d38c6553625259480135c9842729974508f63e5070537cb27e383456053ee617e18211a60476
-
SSDEEP
98304:+ISPJTnlXipoJDTYgEbxvYc/T/P9IRYZNmx8XscmKNVx8wx:tSPJTnHJDk5xAUuRYZoxlQio
Malware Config
Extracted
alienbot
http://wf4sctx9cksg94528o7o.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Removes its main activity from the application launcher 1 TTPs 7 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.ministry.routinely1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
705KB
MD50dc40d906397e52e6240df4564c18cf1
SHA18eb4f0893825e21fa3c55b5c6e55102bf46584a0
SHA256d2ea0d4199fd7319c801b71c1bb06245d6d1ef506647aa93c3c0d98a22eb56dc
SHA5129325a3e25821a382b84d7caf71f4a7d5584fc268ad52e70319f4afcc8e4dcca33a1151980645fce4e624b5ee5190efd37e5de40ea482fb6f0ccd5094edf15384
-
Filesize
705KB
MD574982675f6e91ba1ac1609a17be687b2
SHA1ec81fb0b0e453de80d55aa274c3da0e02a6c9a9a
SHA2564b675d01576154378bc2ddd69911c052285a49c242675452f07cc46544b4d2c5
SHA5129c29d4c47e872bb262c254a7670d1490d974783d192c9bd023d0986cde0c9a8203f27c84c216ca2eceeb9410da743d78b9569ffedec8a6dd820ca2cdebd1792c
-
Filesize
916KB
MD5f0105bb92c0d616bb16c1ce30dc0256e
SHA10e64a1df1c89f7e9a6384595a259eaec3e44905c
SHA256d9d19e9c828254f30f179f180c43727b0ab66a29774645b859b083c6302be70c
SHA51213c885113a2f3f9ce40a376f8c537bf463894ab5304821c50a9c6711698a3b46fff46d1ee7852fad52d4a26019e7f700eea308c10411684ec1a0cb250e62ace7
-
Filesize
254B
MD510c7bdc6cb98d63fe244da428c133efc
SHA1dafc1a077a37b1a7031802f8f23c73e4995bb6ee
SHA25679163db1bbb92dcfc61f58d1b6237170e4f1e102b1eb3267e10f535cf411e3f7
SHA5120939550685c270341982ef1fdfe23406bcab0907dc67676d985dd88bada488e1a2532f4b52a3da868ce75819dfd18a095f327930699db9ec95c18e18735b6a9f