Overview

overview

10

Static

static

6

0086bace2a...9f.apk

android-9-x86

10

0086bace2a...9f.apk

android-10-x64

10

0086bace2a...9f.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    10-01-2025 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0086bace2a2b6d9d922c97e9cd75f300f3e02ffe7f36007108bf0a2f1f39189f.apk

  • Size

    1.5MB

  • MD5

    a76f6f92ed559e1803cf03742b377968

  • SHA1

    7b4d2ab29a2d7a6acc8fc47856da4ed6b01f3b57

  • SHA256

    0086bace2a2b6d9d922c97e9cd75f300f3e02ffe7f36007108bf0a2f1f39189f

  • SHA512

    fa61811fa73f2592f4224c52694b2cade979eeafe3568df4e19ad1383498bcce12946110d83a09a16645d370d58805caee4f3a3c2aaf844144cd8ec4dabafb37

  • SSDEEP

    24576:MSKFrKoWvygWDh7TrO1N/drdBIjNIf97VcdSLj+mv4nrBb8:MBGdg9uL/dk07idSLj+7Bb8

Score
10/10
alienbotcerberusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://45.12.253.155

rc4.plain

Extracted

Family

alienbot

C2

http://45.12.253.155

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Alienbot family
    alienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Cerberus payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 8 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.field.garment
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:5134

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.field.garment/app_DynamicOptDex/mJAI.json
    Filesize

    238KB

    MD5

    015fe6d750580d6796ef6728239c2d77

    SHA1

    734d6dd2a2cdee31d6a6b311800a1861196f6e30

    SHA256

    6fb25641c1d67c6343f00d510f61c897494f5ad3482ece1a39cd9a80ec7faeee

    SHA512

    17e41259a7f8ade39040406f02005ce8385bc42769a4bd3c03dfbd167cd48776ce0a0f636596fe47c88562ef7e41873575ca3b34281b53e58133ef5940b021f0

    Download Submit

  • /data/data/com.field.garment/app_DynamicOptDex/mJAI.json
    Filesize

    238KB

    MD5

    95d4ccf5a95e9c8173382f4aba3335bf

    SHA1

    45216107337949913f682dc5c0c8fe9c78f21067

    SHA256

    9dac189da26808be6fbeb61a6a08121ba84d41ce456064975bdc9c1ae924d8de

    SHA512

    fe025aced9aa496e1e9519d36bc920a2c5ddcceb8b021e98e6550b2931ec97df5dca3d5f02b251152d74a30c63a21e060cb105ee8ddc638939ae8e93cf45f97a

    Download Submit

  • /data/data/com.field.garment/app_DynamicOptDex/oat/mJAI.json.cur.prof
    Filesize

    382B

    MD5

    10838f7970baf7eae4022b55dbec6c46

    SHA1

    6a18a94eafd37ccd0bed83796144839e47c5c190

    SHA256

    cb27a75f1a1b53f7083093b688e6a8a0207af2e90859d41e79f3c3cdf20e0e6c

    SHA512

    8bddffb768f9f67f4b4faf450d30da0754e437c9dfe7410c20fecfe83ef26471cee18cc5db7d653200d3c6eccabe66acabf18df2b107f1c365ea5f383b29b253

    Download Submit

  • /data/user/0/com.field.garment/app_DynamicOptDex/mJAI.json
    Filesize

    483KB

    MD5

    663445c897669ee3a1230e4a583a5818

    SHA1

    afc2d9c6933fddfbc26581e9d9a55c483e4630f2

    SHA256

    056e476cb5708ecad8443ae414b346ab2ff0f99fa5052eed1cdffc3c0b84c865

    SHA512

    77c08af30c99747c355be56f37173dc59253e5a7c23ac9d90c1c7ceee9cabace7caf6b3cf4b645168e9fbe2ec8a1351577693b9c383af5591b7b54f52b0162f4

    Download Submit