Analysis
-
max time kernel
138s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
25/03/2025, 10:54
General
-
Target
03c67802e809e75a774527c60517a5ba7ffdd496bb5efba91e231c45d4a971f8.apk
-
Size
1.6MB
-
MD5
f8f96afdb7b8f09149d3c408bb3ebc9d
-
SHA1
55a330a6e878c25fb0668d77a68c645a4b5277f7
-
SHA256
03c67802e809e75a774527c60517a5ba7ffdd496bb5efba91e231c45d4a971f8
-
SHA512
c13d9dba50a1d9b2bfbf20b58dafef1a6720f6e21df5add56ff67cbb195ccbe76ab7112ef1c8073f4b10647c4068f256bc8e86a7f9dd76641c330fdcae1948d0
-
SSDEEP
24576:/nt/nJgKAIR0IYxxVsvBntmg/VFLvxO0oDaJfdk4q5PiUsdTYS2lXmRBa38F:/ngf4ln/VFbo2fdk4qAUsGWa38F
Malware Config
Extracted
alienbot
http://cemkeskin.xyz/
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Alienbot family
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 8 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
flftowpyhygfa.kchoyulzgssarwo.mlypjkpnjqxbkxztjifzonl1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
698KB
MD5cef8e24389f57dc2a2b92a72da539586
SHA1b114b455cd9eb46034d81356e67902214900a97f
SHA2560d71e77c76f121ea0a1a4f4ca8130586dbe3c8941bae11f5181960c26a2a51cd
SHA512e9ae28fd4c19a17ce34b012414e9911f2d6c0be20b34f1ac251ef47559cbbe9841cbd9cc359c288381eb6bd2ad93c11d766c70376573bd5331890e3acb72c86e
-
Filesize
698KB
MD508b1f6ddcb0157998e5e5fb923faa885
SHA18db192ae7d0b182e8540f6eb7e9e6c60b970d6e0
SHA256020f7686a0d473992d3094be78e798f2ede7a69c2ce34731457475a32368e1e7
SHA512d3d3180aa6f3d3e69837eb39c015f9d707426bcbeab0ae24f7ed73137adf65e4e857c782a0e3ef83dedc1dd8b8305010eecd7ca9d71ed392bdb77f1456aa2c47
-
Filesize
365B
MD53cb4c12ee71fcedd5d58df4c44bc7cf2
SHA1a34e0941ccb1e265059d4bdb5bbc7de642eee09e
SHA256b29f0bb1052014738505fbcbac6c335632975e2d153cc4a3c3efc814cc63c80f
SHA512f13f1960bba7f1da04c2a82711d2a176e9581dd2916f266a4e16632a0b1595d6b7cf2705a64a3940cb65908e70edafcad344a97162d6a9c2caa55ce2c7e327aa