Analysis
-
max time kernel
1794s -
max time network
1809s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
15-01-2025 19:51
General
-
Target
38b398eb1f84dbe4c36e7944e4568676f214508ef3a5ba870aa06639190e60a1.apk
-
Size
3.5MB
-
MD5
b3a51603b7e7194ad4bb5550a68179d7
-
SHA1
6487b6530ad8b94ad43f67a7f7a13d711413e265
-
SHA256
38b398eb1f84dbe4c36e7944e4568676f214508ef3a5ba870aa06639190e60a1
-
SHA512
0a9eb7b843a1e76a3cda1a3045bf12738f09200634d123a49a9bae19dcaead42e5acd67c42fe441e6552feb1e776b371b6068ca8f775d02ab5ed3be45384be72
-
SSDEEP
98304:KfvVA+j2lchnw58tjVHdraRhXjMaGeX0zQieNm4/:w9w5EjVHdyhXgavX08b
Malware Config
Extracted
alienbot
http://greenbook.top
Extracted
alienbot
http://greenbook.top
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 29 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
crazy.artefact.unhappy1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
362B
MD5e4da8339c5899a9d45972b4ca0ae46fc
SHA1ca5db3cd92cc7f40f248ac2cf4981f6a5953ca4b
SHA25698830f0d5614146792c78c3c5e616923e84226d87b2f2641a31a773ab110547c
SHA512d32412f8d14eb6b1c2bf1b5270993db75c0370c08ba77eacd4faf9c4a3faa60652b8ecd4698305c926d3e34ffb6c79ca9bc620f2e748d09940a6cf911dad6c6c
-
Filesize
746KB
MD5d0b68801190d1761c1930ddc980a7f63
SHA1fc1d17f98583203433ef65efee9d6f5317c30bc1
SHA256ea9731b454cd64463c768998cb833dbd8abc017e0a76b6ac138fea683f504427
SHA51269aedddbe2c91fffbd919ff2357467829e2742b58e48751828f60555ecc32880ad800dbc28b95c603183ee3572ce8486233869f89379bf2cc811c7f130e2274e
-
Filesize
746KB
MD55d624e321680fa7f02f0989a86db4c77
SHA17cf4f42ab6a72d6efc738683c0aec6917689e3e0
SHA256bcc4a0825f16cc7be8a94fe514f635a060fea5d69dc7ac06dde1eb1f64c0ff42
SHA512b4724d361d0fb1f3c5d160fb877c87145a338897f6e892bf5e7c9cf6a6ad658f0a10a6959968ed45e1f1e747a121c19057942133a18fd1e4aff82a99daf37d0c