Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
18-12-2024 13:14
General
-
Target
fbadda1aea91b50a5adc6b855b8bbfa4_JaffaCakes118.apk
-
Size
2.9MB
-
MD5
fbadda1aea91b50a5adc6b855b8bbfa4
-
SHA1
80df44dcf743100119e8acbd936a7651887061bd
-
SHA256
d5686b96ed9847a7b5184b70ef9401c3295f50682ad12a9127eb87ec4b4d2feb
-
SHA512
97a117024efcb7e076bce91950784a0ceacd8573a286d69164e21ba662e9957f429ad5121e68c4920b24649c6b326fce6327aa920cbd4c9e6041605ba4ecd7b8
-
SSDEEP
49152:uPdQCR7d+XwoUcT740McyPqFaHUVP6nfl56PyqQSZYfFbdWpHZWsTMKNn7E3Mk:ctgXwodMNgjU956qqQSZYfFb6HRTM38k
Malware Config
Extracted
alienbot
http://194.163.136.78
Extracted
alienbot
http://194.163.136.78
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
bachelor.desk.version1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
697KB
MD5629fd011536d57fd48855a79a8e81adc
SHA18af3a590cf9593cd03504b37573fddad89c7c557
SHA256baf9806357d61e6e451e75650eec0385bed0e74c87812107fda63f35628acfe3
SHA51278ece321d214547cb143413a0952e875d0646d2ab74c0eae3c3b673daf728f4f529612752ca49a589afa933270bea22ea6e2d027d4543b1193fe18c6d6cbd3b0
-
Filesize
697KB
MD5660d53e8aab29da942ba4728544f49a6
SHA14fdc19a08166d93d527b653786451161d958252b
SHA256353e1b2d19562411aff4966064c9704be08f280fc77070e5dc78bac4b2046d2f
SHA5125b879c83d90b0a3b5d19e8fe5381f42bc9de0ea5cd1833f2e2053c2271f8f8ce1e95460c34107cbc2a9a63a56502a6c8187c2f7af792a015aa5d9eb6b652b3a5
-
Filesize
370B
MD5934b2cb93dcfc8903ed1dddfdd49baa3
SHA1e1304f0a9d126ba7ca2c648d4b94ef22a7c3c79e
SHA256ce819297466b1bc0789151f6c1da3121ccdc4a6b50dade64945b6a7d82fcc61c
SHA5126831a3416c63d26c631726635c0b94923dc4b0845c4b017e89fa1618c59376cc30a4d3a3ac2b3c509c0fdede71e09728ef906b3f2410734b0641fc503af52a6d