Overview

overview

10

Static

static

6

03c67802e8...f8.apk

android-9-x86

10

03c67802e8...f8.apk

android-10-x64

10

03c67802e8...f8.apk

android-11-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    25/03/2025, 10:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    03c67802e809e75a774527c60517a5ba7ffdd496bb5efba91e231c45d4a971f8.apk

  • Size

    1.6MB

  • MD5

    f8f96afdb7b8f09149d3c408bb3ebc9d

  • SHA1

    55a330a6e878c25fb0668d77a68c645a4b5277f7

  • SHA256

    03c67802e809e75a774527c60517a5ba7ffdd496bb5efba91e231c45d4a971f8

  • SHA512

    c13d9dba50a1d9b2bfbf20b58dafef1a6720f6e21df5add56ff67cbb195ccbe76ab7112ef1c8073f4b10647c4068f256bc8e86a7f9dd76641c330fdcae1948d0

  • SSDEEP

    24576:/nt/nJgKAIR0IYxxVsvBntmg/VFLvxO0oDaJfdk4q5PiUsdTYS2lXmRBa38F:/ngf4ln/VFbo2fdk4qAUsGWa38F

Score
10/10
alienbotcerberusbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

alienbot

C2

http://cemkeskin.xyz/

Signatures

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot
  • Alienbot family
    alienbot
  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Cerberus payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4214
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl/app_DynamicOptDex/ZWnaZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl/app_DynamicOptDex/oat/x86/ZWnaZ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4240

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl/app_DynamicOptDex/ZWnaZ.json
    Filesize

    698KB

    MD5

    cef8e24389f57dc2a2b92a72da539586

    SHA1

    b114b455cd9eb46034d81356e67902214900a97f

    SHA256

    0d71e77c76f121ea0a1a4f4ca8130586dbe3c8941bae11f5181960c26a2a51cd

    SHA512

    e9ae28fd4c19a17ce34b012414e9911f2d6c0be20b34f1ac251ef47559cbbe9841cbd9cc359c288381eb6bd2ad93c11d766c70376573bd5331890e3acb72c86e

    Download Submit

  • /data/data/flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl/app_DynamicOptDex/ZWnaZ.json
    Filesize

    698KB

    MD5

    08b1f6ddcb0157998e5e5fb923faa885

    SHA1

    8db192ae7d0b182e8540f6eb7e9e6c60b970d6e0

    SHA256

    020f7686a0d473992d3094be78e798f2ede7a69c2ce34731457475a32368e1e7

    SHA512

    d3d3180aa6f3d3e69837eb39c015f9d707426bcbeab0ae24f7ed73137adf65e4e857c782a0e3ef83dedc1dd8b8305010eecd7ca9d71ed392bdb77f1456aa2c47

    Download Submit

  • /data/data/flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl/app_DynamicOptDex/oat/ZWnaZ.json.cur.prof
    Filesize

    516B

    MD5

    993bb3a3daa77999cc94d2b98eb92dcd

    SHA1

    6eabb3631469f40f1c9ff75f4020c0516ebac0eb

    SHA256

    6dd95c1584a4e6d876340a1499027ea1d8531ee0014955ae9ea96626398494cb

    SHA512

    b34046fef38a26a3800382ae72c3cf110fa20ce90a99269f1a263b0a46c8a94a530ce44bd811cda1b89810a0db2a77a16aa627d5d2658d0c848abdc02f4e7173

    Download Submit

  • /data/user/0/flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl/app_DynamicOptDex/ZWnaZ.json
    Filesize

    698KB

    MD5

    337159da24fdb829251ef81df49bfc99

    SHA1

    211d0bde4137babad243b7666f5b7b0ab693a070

    SHA256

    a8eb87ef51eae4658a7c1577318c9fc8cc28762fca803f0eb4c3f64d717b09e1

    SHA512

    003e91200b15df7d3c643af277c7205208ac3bc09a66b5bee88bafe62c1ea2f20bd5034d429948adf28b4d6e9167f43ff5b8d872b4e8b47a4ed4f3ba4d978c95

    Download Submit