Overview

overview

10

Static

static

6

43c689e71c...e6.apk

android-9-x86

10

43c689e71c...e6.apk

android-10-x64

10

43c689e71c...e6.apk

android-11-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    11/02/2025, 22:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    43c689e71c320415b7f29708f3161c0b103e614ccf9a351ea0079f9037dce0e6.apk

  • Size

    2.1MB

  • MD5

    4260b2459cda332600412fa87b45f481

  • SHA1

    a3484491ee140f6f5ae71b5089d13c0a3792acc2

  • SHA256

    43c689e71c320415b7f29708f3161c0b103e614ccf9a351ea0079f9037dce0e6

  • SHA512

    27ad03a62bec8f073f50e9f9db2f9bf096e02475078b1c6955567288e1429dbcc952e9e083fea5117344393fc133c620255c4371a095a5b681db1ccb1ce05089

  • SSDEEP

    49152:b8aGANOIv0yLIXkjGTtGxlWL96jmaS6M9dV/j74sCe2XwuMHo:brN/0yLI0jMtSlWL96yr9j3RhuMI

Score
10/10
alienbotcerberusbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://217.8.117.30

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Alienbot family
    alienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Cerberus payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.keldswlc.cugfkokn
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4261
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.keldswlc.cugfkokn/app_offline/cbeoepejzh.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.keldswlc.cugfkokn/app_offline/oat/x86/cbeoepejzh.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4287

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.keldswlc.cugfkokn/app_offline/cbeoepejzh.jar
    Filesize

    238KB

    MD5

    95bdb42f0d844f8bece50014baa48b42

    SHA1

    3544281e785bbc5c0a055cf867b21cbbb7cc0108

    SHA256

    57a29597fedb435f7756335eefbdca3a2e9221bd4a769b3e3fdf7f294fec234c

    SHA512

    1da32b817f40aaa59b28486da8c1cb357dbd08991a75b11b0b1c42cc7598fa1192dfb7f84c6f9cdd84ddb2092deb9f1baa1c30260226642bc050f100d162f9c1

    Download Submit

  • /data/data/com.keldswlc.cugfkokn/app_offline/oat/cbeoepejzh.jar.cur.prof
    Filesize

    485B

    MD5

    0f3aa774ddb3694e8e20398d063b3c6f

    SHA1

    3075bcf2a2cd4f1d3f713c79649d218b10cd6dc3

    SHA256

    9b415e574376379f634a227bfd7f89ec75ef41b47522b7150533c4e4d77ecb3e

    SHA512

    3b96a359298ae9f0204a71dd6358cf474d80b8475302df007b245ca2ce35b4fe8d91d8ce7863286eb8f7d7e1b2a1d9ca1b0e30311038fc56cd3a783d7eba0ee0

    Download Submit

  • /data/user/0/com.keldswlc.cugfkokn/app_offline/cbeoepejzh.jar
    Filesize

    474KB

    MD5

    2940696343c37e1aae7db3d67ec872f4

    SHA1

    c6c49f7ff410df9829852e4863f84d3702cf07fc

    SHA256

    9715c0a9dff8d83d7ae4a4cadacb356544c8ee282a58d8fcec30b8570ff28e83

    SHA512

    f3fc865fc196b5ca596ae57c73b53869891b259a99755224ba4b98c0ccc1ee1b20d29600eec514122950edba1e72c7bac2cde1c85e7ecdeece99de6dab9f9d12

    Download Submit

  • /data/user/0/com.keldswlc.cugfkokn/app_offline/cbeoepejzh.jar
    Filesize

    474KB

    MD5

    101181d072ca70e0834507c716d103e1

    SHA1

    3178e5c95730c8d63e2d9039014ebde64bcfdd38

    SHA256

    f933e6f36f05db688a59316f597a22aede3764a54475cecacf94ed7bb38ec947

    SHA512

    f52e26f28c7a22d63e8a00fd6fdfa717b0f7fc96625844a9de2d7d6409295e2c564014578a0b22aa7b993cbd5b7db462aea57b2087cd3d38b7de06f403ce2548

    Download Submit