aberebot | e70e9e17f4083ab8a8620a9eed08ec1b06b598db1a8d3711992cfd219bf65afb[.]zip

General

Target

e70e9e17f4083ab8a8620a9eed08ec1b06b598db1a8d3711992cfd219bf65afb.zip
Size

1.3MB
MD5

b0fa8413d3de444118fdf0484721d1a9
SHA1

0a84e6293aec49a028519146a976a9cde9255b48
SHA256

e70e9e17f4083ab8a8620a9eed08ec1b06b598db1a8d3711992cfd219bf65afb
SHA512

89afbe5852747dc5cdb63d343b93b4bc6058897b50a5a6b85e85a434a54be577a84f9a8ef8130daa9465f6b2a337d2f1be3753b0d4033bbe22db781f49d2d896
SSDEEP

24576:tsNyTbtadFkVk+7qic8JzoQ8TsrRyXhjv2SOQWZfXExtj:tsNsbs6VNhkOwxjvBWpUxtj

Score

10^/10

aberebot

Malware Config

Extracted

Family

aberebot

C2

https://api.telegram.org/bot1962569196:AAHM6U4h6BTtbS762JueoJUyaCXb4dBjeyA/getUpdates?offset=

https://api.telegram.org/bot1962569196:AAHM6U4h6BTtbS762JueoJUyaCXb4dBjeyA/sendMessage?chat_id=-1001612354163&text=

Signatures

Aberebot family
aberebot

Aberebot payload 1 IoCs

resource	yara_rule
static1/unpack001/ee20d6abcf80df3a02c99b977ae6c948d2449f573daa9204ccc9fab6825883f3.apk	family_aberebot2

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS

Files

e70e9e17f4083ab8a8620a9eed08ec1b06b598db1a8d3711992cfd219bf65afb.zip
.zip

Password: infected
ee20d6abcf80df3a02c99b977ae6c948d2449f573daa9204ccc9fab6825883f3.apk
.apk android

com.example.autoclicker

com.example.bot.MainActivity

Activities

com.example.bot.MainActivity

android.intent.action.MAIN

com.example.bot.zpokjkjlkjhjlkdfb

android.intent.action.SEND
android.intent.action.SENDTO

Permissions

android.permission.QUERY_ALL_PACKAGES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.RECEIVE_SMS
android.permission.INTERNET
android.permission.READ_CONTACTS
android.permission.WRITE_SMS
android.permission.READ_SMS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.BROADCAST_SMS
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_MMS
android.permission.FOREGROUND_SERVICE

Receivers

com.example.bot.SmsReceiver

android.provider.Telephony.SMS_DELIVER
android.provider.Telephony.SMS_RECEIVED

com.example.bot.zcvbcvbcvbcvbxnmhf

android.provider.Telephony.WAP_PUSH_DELIVER

com.example.bot.BootReceiver

android.intent.action.BOOT_COMPLETED

Services

com.example.bot.AccessibilityService

android.accessibilityservice.AccessibilityService

com.example.bot.zcmjghmgjhgjtyr

android.intent.action.RESPOND_VIA_MESSAGE

com.example.bot.NListener

android.service.notification.NotificationListenerService

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

com.example.autoclicker

com.example.bot.MainActivity

Activities

com.example.bot.MainActivity

com.example.bot.zpokjkjlkjhjlkdfb

Permissions

Receivers

com.example.bot.SmsReceiver

com.example.bot.zcvbcvbcvbcvbxnmhf

com.example.bot.BootReceiver

Services

com.example.bot.AccessibilityService

com.example.bot.zcmjghmgjhgjtyr

com.example.bot.NListener