Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
18-12-2024 13:14
General
-
Target
fbadda1aea91b50a5adc6b855b8bbfa4_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
fbadda1aea91b50a5adc6b855b8bbfa4
-
SHA1
80df44dcf743100119e8acbd936a7651887061bd
-
SHA256
d5686b96ed9847a7b5184b70ef9401c3295f50682ad12a9127eb87ec4b4d2feb
-
SHA512
97a117024efcb7e076bce91950784a0ceacd8573a286d69164e21ba662e9957f429ad5121e68c4920b24649c6b326fce6327aa920cbd4c9e6041605ba4ecd7b8
-
SSDEEP
49152:uPdQCR7d+XwoUcT740McyPqFaHUVP6nfl56PyqQSZYfFbdWpHZWsTMKNn7E3Mk:ctgXwodMNgjU956qqQSZYfFb6HRTM38k
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
bachelor.desk.version1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
697KB
MD5629fd011536d57fd48855a79a8e81adc
SHA18af3a590cf9593cd03504b37573fddad89c7c557
SHA256baf9806357d61e6e451e75650eec0385bed0e74c87812107fda63f35628acfe3
SHA51278ece321d214547cb143413a0952e875d0646d2ab74c0eae3c3b673daf728f4f529612752ca49a589afa933270bea22ea6e2d027d4543b1193fe18c6d6cbd3b0
-
Filesize
697KB
MD5660d53e8aab29da942ba4728544f49a6
SHA14fdc19a08166d93d527b653786451161d958252b
SHA256353e1b2d19562411aff4966064c9704be08f280fc77070e5dc78bac4b2046d2f
SHA5125b879c83d90b0a3b5d19e8fe5381f42bc9de0ea5cd1833f2e2053c2271f8f8ce1e95460c34107cbc2a9a63a56502a6c8187c2f7af792a015aa5d9eb6b652b3a5
-
Filesize
417B
MD54f5fdbfbdc4e96f7e167f459278106fc
SHA131dc96e497773eca8770d6b565064f006a2f1665
SHA256150d50c971705319af3ab3e4200348430d4455117f69dc470fad78ee97f6f5cd
SHA512d3425119463378eca30f14c3f07bcb7ae46e10f378a54a7160ad60ef798b8c6e21765bda129e9cee741368bbf120ac2072f02891e55b8c936092efc1ab09a38a