Analysis
-
max time kernel
141s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
29-12-2024 22:04
General
-
Target
38b398eb1f84dbe4c36e7944e4568676f214508ef3a5ba870aa06639190e60a1.apk
-
Size
3.5MB
-
MD5
b3a51603b7e7194ad4bb5550a68179d7
-
SHA1
6487b6530ad8b94ad43f67a7f7a13d711413e265
-
SHA256
38b398eb1f84dbe4c36e7944e4568676f214508ef3a5ba870aa06639190e60a1
-
SHA512
0a9eb7b843a1e76a3cda1a3045bf12738f09200634d123a49a9bae19dcaead42e5acd67c42fe441e6552feb1e776b371b6068ca8f775d02ab5ed3be45384be72
-
SSDEEP
98304:KfvVA+j2lchnw58tjVHdraRhXjMaGeX0zQieNm4/:w9w5EjVHdyhXgavX08b
Malware Config
Extracted
alienbot
http://greenbook.top
Extracted
alienbot
http://greenbook.top
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
crazy.artefact.unhappy1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388B
MD53d727b430de9cf8e0d6a77a44044ce76
SHA1e94ef6c99219447b6f50f39ca76479bcd41b2a4c
SHA256fe62a0c12805077b3b6117e405e6854619306ad8c1d5ede1e2e44238f2a8874d
SHA512cb36da34dee2c993c6baf3a6901517950912c58f58482201e401e69c10f9d9bf0a18dc78292119599cdd69ec042142127aef3f6bdd95dadb1b625fb45b4df27d
-
Filesize
746KB
MD5d0b68801190d1761c1930ddc980a7f63
SHA1fc1d17f98583203433ef65efee9d6f5317c30bc1
SHA256ea9731b454cd64463c768998cb833dbd8abc017e0a76b6ac138fea683f504427
SHA51269aedddbe2c91fffbd919ff2357467829e2742b58e48751828f60555ecc32880ad800dbc28b95c603183ee3572ce8486233869f89379bf2cc811c7f130e2274e
-
Filesize
746KB
MD55d624e321680fa7f02f0989a86db4c77
SHA17cf4f42ab6a72d6efc738683c0aec6917689e3e0
SHA256bcc4a0825f16cc7be8a94fe514f635a060fea5d69dc7ac06dde1eb1f64c0ff42
SHA512b4724d361d0fb1f3c5d160fb877c87145a338897f6e892bf5e7c9cf6a6ad658f0a10a6959968ed45e1f1e747a121c19057942133a18fd1e4aff82a99daf37d0c